CVE-2026-64554

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

The vulnerable code is the bridge forwarding/refragmentation path, driven entirely by frames received on a bridge port from an L2 peer — typically a guest VM over tap/virtio or a container over veth, which per skbuff.h are exactly the sources that deliver CHECKSUM_PARTIAL skbs on receive. This is logically adjacent topology (bridged segment/overlay), not a routed internet path, so AV:A rather than N.

AC:LAttack complexity, low

The attacker controls every precondition: send IPv6 fragments (forces conntrack reassembly and sets frag_max_size), set VIRTIO_NET_HDR_F_NEEDS_CSUM for CHECKSUM_PARTIAL, and target a broadcast/multicast/unknown-unicast MAC so br_flood calls deliver_clone() and makes the skb cloned. No race and no attacker-independent condition is involved; the corruption is deterministic once the packet is crafted.

PR:NPrivileges required, none

A guest VM or container attached to the host bridge holds no credentials on the vulnerable host and needs none — it merely emits frames onto the segment. In the equivalent local variant the entire setup (bridge, veth, nft bridge conntrack, AF_PACKET with CAP_NET_RAW) is reachable from an unprivileged user namespace, so no real privilege is required either way.

UI:NUser interaction, none

The corruption happens automatically in softirq context while the bridge forwards the attacker's packet. No action by any user or administrator on the target is needed.

S:UScope, unchanged

The vulnerable component and the impacted resource are both the host kernel's network stack; no hypervisor, IOMMU, or sandbox boundary is bypassed by the bug itself. Standard kernel memory corruption is scored Unchanged.

C:HConfidentiality impact, high

This is a use-after-free/out-of-bounds write on the slab; the freed skb head and the write target can be groomed by the attacker, and such heap corruption is routinely leveraged into arbitrary kernel memory disclosure. Per kernel scoring guidance, UAF/OOB corruption is High confidentiality impact.

I:HIntegrity impact, high

ip6_frag_next() writes NEXTHDR_FRAGMENT (0x2c) at skb_network_header(frag) plus an uncontrolled inter-allocation delta, giving a repeatable 1-byte heap write at a heap-groomable offset — once per emitted fragment. A controlled byte write into adjacent slab objects is a classic primitive for corrupting kernel data structures and escalating to control-flow hijack.

A:HAvailability impact, high

KASAN reports a slab-use-after-free write followed by "Kernel panic - not syncing: Fatal exception in interrupt" because the fault occurs in softirq forwarding context, taking down the whole host rather than one task. The attacker can repeat it at will with a stream of crafted fragments.