UBUNTU-CVE-2026-64554: Use After Free

Q: Which Ubuntu kernel packages are listed as affected?

The listed packages are ubuntu/linux, ubuntu/linux-aws-fips, ubuntu/linux-azure, ubuntu/linux-azure-fips, ubuntu/linux-fips, ubuntu/linux-gcp, ubuntu/linux-gcp-fips, and ubuntu/linux-realtime.

Q: What conditions are involved in triggering this issue?

The vulnerable path is in IPv6 fragmentation for bridged traffic handled by netfilter. The stale pointer occurs when br_ip6_fragment() processes a cloned skb and skb_checksum_help() reallocates its head.

Q: What level of access does an attacker need according to the supplied severity vector?

The vector indicates local attack access, high attack complexity, low privileges required, and no user interaction. It rates confidentiality, integrity, and availability impact as high.

Q: What is the observed failure mode?

A pointer into the skb head can become dangling after skb_checksum_help() reallocates that head. A later call to ip6_frag_next() dereferences it, resulting in a use-after-free write.

Published Jul 27, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in brip6fragment() brip6fragment() gets prevhdr, a pointer into the skb head, from ip6find1stfragopt(), then calls skbchecksumhelp(). For a cloned skb skbchecksumhelp() reallocates the head via pskbexpandhead(), leaving prevhdr dangling. It is later dereferenced in ip6fragnext(), causing a use-after-free write. Save prevhdr's offset before skbchecksumhelp() and recompute it after, like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment"). BUG: KASAN: slab-use-after-free in ip6fragnext (net/ipv6/ip6output.c:857) Write of size 1 at addr ffff888013ff5016 by task exploit/141 Call Trace: ... kasanreport (mm/kasan/report.c:595) ip6fragnext (net/ipv6/ip6output.c:857) brip6fragment (net/ipv6/netfilter.c:212) nfctbridgepost (net/bridge/netfilter/nfconntrackbridge.c:407) nfhookslow (net/netfilter/core.c:619) brforwardfinish (net/bridge/brforward.c:66) brforward (net/bridge/brforward.c:115) maybedeliver (net/bridge/brforward.c:191) brflood (net/bridge/brforward.c:245) brhandleframefinish (net/bridge/brinput.c:229) brhandleframe (net/bridge/brinput.c:442) ... packetsendmsg (net/packet/afpacket.c:3114) ... dosyscall64 (arch/x86/entry/syscall64.c:94) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:121) Kernel panic - not syncing: Fatal exception in interrupt

Affected Software

226 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4*

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4*

ubuntu/linux-raspi-5.4*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15<5.15.0-1117.124~20.04.1

5.15.0-1117.124~20.04.1

ubuntu/linux-aws-5.8*

ubuntu/linux-azure*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15<5.15.0-1123.132~20.04.1

5.15.0-1123.132~20.04.1

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15<5.15.0-1122.131~20.04.1

5.15.0-1122.131~20.04.1

ubuntu/linux-bluefield*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15<5.15.0-1118.128~20.04.1

5.15.0-1118.128~20.04.1

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15<5.15.0-198.208~20.04.1

5.15.0-198.208~20.04.1

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm*

ubuntu/linux-ibm-5.15<5.15.0-1111.115~20.04.1

5.15.0-1111.115~20.04.1

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15<5.15.0-1112.118~20.04.1

5.15.0-1112.118~20.04.1

ubuntu/linux-iot*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-195.205~20.04.1

5.15.0-195.205~20.04.1

ubuntu/linux-nvidia-tegra-5.15*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15<5.15.0-1114.120~20.04.1

5.15.0-1114.120~20.04.1

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15<5.15.0-1111.115~20.04.1

5.15.0-1111.115~20.04.1

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-198.208

5.15.0-198.208

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1117.124

5.15.0-1117.124

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8*

ubuntu/linux-azure<5.15.0-1123.132

5.15.0-1123.132

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8*

ubuntu/linux-azure-fde<5.15.0-1122.131

5.15.0-1122.131

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8*

ubuntu/linux-gcp<5.15.0-1118.128

5.15.0-1118.128

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8*

ubuntu/linux-gke<5.15.0-1113.119

5.15.0-1113.119

ubuntu/linux-gkeop<5.15.0-1100.108

5.15.0-1100.108

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1111.115

5.15.0-1111.115

ubuntu/linux-ibm-6.8*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1112.118

5.15.0-1112.118

ubuntu/linux-kvm<5.15.0-1109.114

5.15.0-1109.114

ubuntu/linux-lowlatency<5.15.0-195.205

5.15.0-195.205

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8*

ubuntu/linux-nvidia<5.15.0-1112.113

5.15.0-1112.113

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8*

ubuntu/linux-nvidia-tegra*

ubuntu/linux-nvidia-tegra-igx*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1114.120

5.15.0-1114.120

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8*

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1080.84

5.15.0-1080.84

ubuntu/linux-bluefield<5.15.0-1101.103

5.15.0-1101.103

ubuntu/linux-intel-iot-realtime<5.15.0-1109.111

5.15.0-1109.111

ubuntu/linux-realtime<5.15.0-1116.125

5.15.0-1116.125

ubuntu/linux-realtime-6.8*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1117.124+fips1

5.15.0-1117.124+fips1

ubuntu/linux-azure-fips<5.15.0-1123.132+fips1

5.15.0-1123.132+fips1

ubuntu/linux-fips<5.15.0-198.208+fips1

5.15.0-198.208+fips1

ubuntu/linux-gcp-fips<5.15.0-1118.128+fips1

5.15.0-1118.128+fips1

ubuntu/linux<6.8.0-147.147

6.8.0-147.147

ubuntu/linux-aws<6.8.0-1067.70

6.8.0-1067.70

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-azure<6.8.0-1071.79

6.8.0-1071.79

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0<7.0.0-1017.17~24.04.1

7.0.0-1017.17~24.04.1

ubuntu/linux-azure-fde<6.8.0-1069.76

6.8.0-1069.76

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0<7.0.0-1016.16~24.04.1

7.0.0-1016.16~24.04.1

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1071.79

6.8.0-1071.79

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-gke<6.8.0-1066.74

6.8.0-1066.74

ubuntu/linux-gkeop<6.8.0-1052.56

6.8.0-1052.56

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0<7.0.0-38.38~24.04.4

7.0.0-38.38~24.04.4

ubuntu/linux-ibm<6.8.0-1067.68

6.8.0-1067.68

ubuntu/linux-lowlatency<6.8.0-147.147.1

6.8.0-147.147.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0*

ubuntu/linux-nvidia-lowlatency*

ubuntu/linux-nvidia-tegra<6.8.0-1035.38

6.8.0-1035.38

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1064.67

6.8.0-1064.67

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0<7.0.0-1013.13~24.04.1

7.0.0-1013.13~24.04.1

ubuntu/linux-raspi*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-38.38.1~24.04.1

7.0.0-38.38.1~24.04.1

ubuntu/linux-xilinx*

ubuntu/linux-bluefield<6.8.0-1033.38

6.8.0-1033.38

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime<6.8.1-1062.63

6.8.1-1062.63

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux-aws-fips<6.8.0-1067.70+fips1

6.8.0-1067.70+fips1

ubuntu/linux-azure-fips<6.8.0-1071.79+fips1

6.8.0-1071.79+fips1

ubuntu/linux-fips<6.8.0-147.147+fips1

6.8.0-147.147+fips1

ubuntu/linux-gcp-fips<6.8.0-1071.79+fips1

6.8.0-1071.79+fips1

ubuntu/linux<7.0.0-38.38

7.0.0-38.38

ubuntu/linux-aws<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-azure<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-azure-fde<7.0.0-1016.16

7.0.0-1016.16

ubuntu/linux-gcp<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-gke<7.0.0-1008.9

7.0.0-1008.9

ubuntu/linux-ibm<7.0.0-1015.15

7.0.0-1015.15

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-bos*

ubuntu/linux-oem-7.0<7.0.0-1015.15

7.0.0-1015.15

ubuntu/linux-oracle<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-raspi*

ubuntu/linux-realtime<7.0.0-38.38.1

7.0.0-38.38.1

ubuntu/linux-riscv<7.0.0-38.38.1

7.0.0-38.38.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1117.124~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1123.132~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1122.131~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1118.128~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-198.208~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.115~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1112.118~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-195.205~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1114.120~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.115~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-198.208
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1117.124
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1123.132
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1122.131
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1118.128
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1113.119
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1100.108
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.115
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1112.118
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1109.114
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-195.205
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1112.113
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1114.120
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1080.84
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1101.103
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1109.111
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1116.125
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1117.124+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1123.132+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-198.208+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1118.128+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-147.147
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.70
Upgrade
Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1071.79
Upgrade
Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1069.76
Upgrade
Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1071.79
Upgrade
Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1066.74
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.56
Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38~24.04.4
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.68
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-147.147.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1035.38
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.67
Upgrade
Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1~24.04.1
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1033.38
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1062.63
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.70+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1071.79+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-147.147+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1071.79+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 7.0.0-1008.9
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.15
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.15
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1

Event History

Jul 27, 2026

CVE Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Ubuntu kernel packages are listed as affected?

The listed packages are ubuntu/linux, ubuntu/linux-aws-fips, ubuntu/linux-azure, ubuntu/linux-azure-fips, ubuntu/linux-fips, ubuntu/linux-gcp, ubuntu/linux-gcp-fips, and ubuntu/linux-realtime.

What conditions are involved in triggering this issue?

The vulnerable path is in IPv6 fragmentation for bridged traffic handled by netfilter. The stale pointer occurs when br_ip6_fragment() processes a cloned skb and skb_checksum_help() reallocates its head.

What level of access does an attacker need according to the supplied severity vector?

The vector indicates local attack access, high attack complexity, low privileges required, and no user interaction. It rates confidentiality, integrity, and availability impact as high.

What is the observed failure mode?

A pointer into the skb head can become dangling after skb_checksum_help() reallocates that head. A later call to ip6_frag_next() dereferences it, resulting in a use-after-free write.

UBUNTU-CVE-2026-64554: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ubuntu kernel packages are listed as affected?

What conditions are involved in triggering this issue?

What level of access does an attacker need according to the supplied severity vector?

What is the observed failure mode?

Company

Resources

Contact