The vulnerability in the Linux kernel involves the netfilter bridge component's br_ip6_fragment() function, where a stale pointer (prevhdr) is used after skb_checksum_help() reallocates the skb head for cloned skbs. This results in a use-after-free write in ip6_frag_next(), potentially causing a kernel panic. The fix involves saving the offset of prevhdr before skb_checksum_help() and recomputing it afterward to avoid dangling pointers, similar to a previous commit addressing a related IPv6 fragmentation issue.

Successful exploitation can lead to a use-after-free write in kernel memory, causing a kernel panic and potential denial of service. The CVSS vector indicates high impact on confidentiality, integrity, and availability, meaning an attacker could cause system crashes or potentially execute arbitrary code with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposure to untrusted IPv6 fragmented packets on bridged interfaces or apply any vendor-recommended temporary mitigations if provided.