Skip to main content

Linux Kernel CVE-2026-64554

| EUVDEUVD-2026-49605 HIGH
2026-07-27 Linux GHSA-435j-q3ff-8922
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.1 HIGH

Adjacent L2 reach with no auth or interaction (AV:A/PR:N/UI:N); demonstrated impact is a write-UAF causing kernel memory corruption and panic (I:H/A:H), no info disclosure (C:N).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 30, 2026 - 06:53 vuln.today
CVSS changed
Jul 30, 2026 - 06:37 NVD
8.8 (HIGH)
Patch available
Jul 27, 2026 - 21:17 EUVD
CVE Published
Jul 27, 2026 - 20:10 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 27, 2026 - 20:10 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()

br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb skb_checksum_help() reallocates the head via pskb_expand_head(), leaving prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a use-after-free write.

Save prevhdr's offset before skb_checksum_help() and recompute it after, like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment").

BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857) Write of size 1 at addr ffff888013ff5016 by task exploit/141 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip6_frag_next (net/ipv6/ip6_output.c:857) br_ip6_fragment (net/ipv6/netfilter.c:212) nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407) nf_hook_slow (net/netfilter/core.c:619) br_forward_finish (net/bridge/br_forward.c:66) __br_forward (net/bridge/br_forward.c:115) maybe_deliver (net/bridge/br_forward.c:191) br_flood (net/bridge/br_forward.c:245) br_handle_frame_finish (net/bridge/br_input.c:229) br_handle_frame (net/bridge/br_input.c:442) ... packet_sendmsg (net/packet/af_packet.c:3114) ... do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt

AnalysisAI

Use-after-free write in the Linux kernel's bridge netfilter IPv6 fragmentation path (br_ip6_fragment) lets an adjacent attacker corrupt kernel memory and crash the host. The flaw affects systems acting as bridges with connection-tracking (nf_conntrack_bridge) forwarding IPv6 traffic, where a stale prevhdr pointer is dereferenced after skb_checksum_help() reallocates the skb head for a cloned packet. There is no public exploit identified at time of analysis and it is not in CISA KEV; the reported KASAN trace demonstrates a reliable kernel panic (denial of service), with memory-corruption escalation theoretically possible.

Technical ContextAI

The vulnerability lives in the netfilter bridge connection-tracking post-routing hook (net/bridge/netfilter/nf_conntrack_bridge.c) which calls br_ip6_fragment() (net/ipv6/netfilter.c) to refragment oversized IPv6 frames traversing a Linux bridge. br_ip6_fragment() obtains 'prevhdr', a raw pointer into the skb linear header, from ip6_find_1stfragopt(), then invokes skb_checksum_help(). For a cloned skb (common when a bridge floods a frame to multiple ports), skb_checksum_help() calls pskb_expand_head() to reallocate the skb head, which frees the old buffer and leaves prevhdr dangling. ip6_frag_next() (net/ipv6/ip6_output.c:857) later writes through that stale pointer, a slab use-after-free. The root cause is CWE-416 (Use After Free) - the CWE field is N/A in the feed but the KASAN 'slab-use-after-free' report and the fix (save prevhdr's offset before the checksum call and recompute it after, mirroring commit ef0efcd3bd3f) confirm the class. Per the CPE strings (cpe:2.3:a:linux:linux) this is upstream Linux kernel code, not a distro-specific patch.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5 (or mainline 7.2-rc4) - matching your branch; the fix saves prevhdr's byte offset before skb_checksum_help() and recomputes the pointer afterward. Apply your distribution's backported kernel update as soon as it ships. If immediate patching is not possible on a bridging host, the most direct compensating control is to unload or blocklist the nf_conntrack_bridge module (e.g., remove the bridge conntrack hook), which eliminates the vulnerable code path - the trade-off is loss of stateful connection tracking for bridged traffic. Alternatively, disable IPv6 forwarding across the bridge or avoid IPv6 fragmentation/PMTU conditions on bridged interfaces if the workload permits; this removes exposure at the cost of IPv6 bridging functionality. Reference the stable commits at https://git.kernel.org/stable/c/8c10778ec674b67a07ea042fcba64270f3f38a5a and related trees. Restricting which hosts can inject IPv6 traffic onto the bridged L2 segment reduces the adjacent-attacker surface.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64554 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy