CVE-2026-64554

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free write occurs in the netfilter bridge component. The function br ip6 fragment() obtains a pointer prevhdr to the socket buffer (skb) head via ip6 find 1stfragopt(). When skb checksum help() is subsequently called for a cloned skb, it reallocates the head using pskb expand head(), which leaves the prevhdr pointer dangling. This dangling pointer is later dereferenced in the ip6 frag next() function, leading to a memory corruption issue that can cause a kernel panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.