CVE-2026-64554: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-64554 is a use-after-free vulnerability in the Linux kernel's netfilter bridge code, specifically in the br_ip6_fragment() function. The flaw was published on July 27, 2026, and affects Linux kernel versions starting from 5.3 up through multiple stable branches. Fixed versions include 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc4. The vulnerability is estimated as Medium severity by Feedly; no official CVSS score has been assigned at time of publication (GitHub Advisory).

The root cause is a dangling pointer (use-after-free, CWE-416) in br_ip6_fragment(). The function obtains prevhdr, a pointer into the socket buffer (skb) head, via ip6_find_1stfragopt(). When skb_checksum_help() is subsequently called on a cloned skb, it reallocates the skb head via pskb_expand_head(), invalidating the prevhdr pointer. The stale pointer is later dereferenced in ip6_frag_next(), resulting in a write to freed memory. The fix saves prevhdr's offset before calling skb_checksum_help() and recomputes the pointer afterward, mirroring the approach used in commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment"). Exploitation requires local access with the ability to send crafted network packets via packet sockets or bridge interfaces (GitHub Advisory).

A local attacker with access to raw packet sockets or bridge interfaces can trigger a write to freed kernel memory, potentially achieving local code execution with kernel privileges. Successful exploitation could lead to full system compromise, privilege escalation, or kernel panic (denial of service), as evidenced by the KASAN trace showing a fatal exception in interrupt context. The scope is limited to the local system, but kernel-level code execution could enable complete confidentiality, integrity, and availability compromise of the affected host (GitHub Advisory).

1. Gain local access: Obtain a local user account on a Linux system running a vulnerable kernel (5.3 through versions prior to the fixed releases), with access to raw packet sockets (e.g., CAP_NET_RAW capability or equivalent).
2. Set up a bridge interface: Ensure the target system has a bridge interface configured with IPv6 and netfilter bridge connection tracking enabled (nf_conntrack_bridge module loaded).
3. Craft a cloned IPv6 packet requiring fragmentation: Using a packet socket (AF_PACKET), craft and send an IPv6 packet that requires fragmentation and triggers the checksum computation path in br_ip6_fragment() — specifically targeting the code path where skb_checksum_help() is called on a cloned skb.
4. Trigger the use-after-free: The crafted packet causes skb_checksum_help() to reallocate the skb head via pskb_expand_head(), leaving the prevhdr pointer dangling. When ip6_frag_next() dereferences this stale pointer, a write to freed memory occurs.
5. Achieve kernel code execution: By controlling the freed memory region (e.g., via heap spray techniques), an attacker may redirect kernel execution flow to attain privilege escalation or arbitrary code execution (GitHub Advisory).

• Logs: KASAN reports in kernel logs (dmesg) with messages such as BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857) and Write of size 1 at addr ... attributed to a process named exploit.
• Logs: Kernel panic messages referencing Fatal exception in interrupt following the KASAN report, with a call trace including br_ip6_fragment, nf_ct_bridge_post, nf_hook_slow, and packet_sendmsg.
• Process: Unusual processes with names like exploit sending packets via AF_PACKET sockets (packet_sendmsg in call trace).
• Network: Unexpected IPv6 fragmented traffic originating from local processes traversing bridge interfaces with netfilter connection tracking enabled (GitHub Advisory).

Apply the available kernel patches for the respective stable branches: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc4. Patch commits are available at the Linux stable kernel repository for each affected branch. As a temporary workaround, restrict unprivileged access to raw packet sockets (e.g., set kernel.unprivileged_userns_clone=0 or restrict CAP_NET_RAW) and unload the nf_conntrack_bridge module if bridge netfilter connection tracking is not required. Monitor kernel logs for KASAN use-after-free warnings related to ip6_frag_next() as an indicator of exploitation attempts (GitHub Advisory).