{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.180-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()  br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help().  For a cloned skb skb_checksum_help() reallocates the head via pskb_expand_head(), leaving prevhdr dangling.  It is later dereferenced in ip6_frag_next(), causing a use-after-free write.  Save prevhdr's offset before skb_checksum_help() and recompute it after, like commit ef0efcd3bd3f (\"ipv6: Fix dangling pointer when ipv6 fragment\").    BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857)   Write of size 1 at addr ffff888013ff5016 by task exploit/141   Call Trace:    ...    kasan_report (mm/kasan/report.c:595)    ip6_frag_next (net/ipv6/ip6_output.c:857)    br_ip6_fragment (net/ipv6/netfilter.c:212)    nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407)    nf_hook_slow (net/netfilter/core.c:619)    br_forward_finish (net/bridge/br_forward.c:66)    __br_forward (net/bridge/br_forward.c:115)    maybe_deliver (net/bridge/br_forward.c:191)    br_flood (net/bridge/br_forward.c:245)    br_handle_frame_finish (net/bridge/br_input.c:229)    br_handle_frame (net/bridge/br_input.c:442)    ...    packet_sendmsg (net/packet/af_packet.c:3114)    ...    do_syscall_64 (arch/x86/entry/syscall_64.c:94)    entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)   Kernel panic - not syncing: Fatal exception in interrupt",
  "id": "DEBIAN-CVE-2026-64554",
  "modified": "2026-09-14T16:47:36.013219477Z",
  "published": "2026-07-27T21:17:08.437Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64554"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-64554"
  ]
}