A use‑after‑free flaw exists in the Linux kernel’s netfilter bridge code when handling IPv6 fragment packets. The function br_ip6_fragment() obtains a pointer to a header within the socket buffer and then invokes skb_checksum_help(), which can reallocate the buffer and leave the pointer dangling. The stale pointer is later dereferenced in ip6_frag_next(), writing to freed memory. This compromises kernel memory integrity and can result in a kernel panic, effectively denying service for the affected system.

All Linux kernel builds that incorporate the netfilter bridge subsystem are affected, as indicated by the generic Linux kernel description. No specific version range is provided; any kernel image older than the commit that introduced the fix is assumed vulnerable. The vulnerable code paths reside in net/ipv6/ip6_output.c and net/ipv6/netfilter.c and are triggered when IPv6 fragment packets are forwarded through a bridged interface.

The CVSS score is 8.8, reflecting a high‑severity flaw. The EPSS score is reported as < 1 %, indicating a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is the delivery of specially crafted IPv6 packets that trigger the fragment handling path over a bridged interface. An attacker who can send such packets can corrupt kernel memory, potentially causing a system crash and denial of service.