CVE-2026-64554

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bridge: fix stale prevhdr pointer in brip6fragment()

brip6fragment() gets prevhdr, a pointer into the skb head, from ip6find1stfragopt(), then calls skbchecksumhelp(). For a cloned skb skbchecksumhelp() reallocates the head via pskbexpandhead(), leaving prevhdr dangling. It is later dereferenced in ip6fragnext(), causing a use-after-free write.

Save prevhdr's offset before skbchecksumhelp() and recompute it after, like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment").

BUG: KASAN: slab-use-after-free in ip6fragnext (net/ipv6/ip6output.c:857) Write of size 1 at addr ffff888013ff5016 by task exploit/141 Call Trace: ... kasanreport (mm/kasan/report.c:595) ip6fragnext (net/ipv6/ip6output.c:857) brip6fragment (net/ipv6/netfilter.c:212) nfctbridgepost (net/bridge/netfilter/nfconntrackbridge.c:407) nfhookslow (net/netfilter/core.c:619) brforwardfinish (net/bridge/br_forward.c:66) _brforward (net/bridge/brforward.c:115) maybedeliver (net/bridge/brforward.c:191) brflood (net/bridge/brforward.c:245) brhandleframefinish (net/bridge/brinput.c:229) brhandleframe (net/bridge/brinput.c:442) ... packetsendmsg (net/packet/afpacket.c:3114) ... dosyscall64 (arch/x86/entry/syscall64.c:94) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:121) Kernel panic - not syncing: Fatal exception in interrupt