CVE-2026-64132

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv6: ioam: refresh hdr pointer before ioam6_event()<br /> <br /> Reported by Sashiko:<br /> <br /> In ipv6_hop_ioam(), the hdr pointer is initialized to point into the<br /> skb&amp;#39;s linear data buffer. Later, the code calls skb_ensure_writable(),<br /> which might reallocate the buffer:<br /> <br /> if (skb_ensure_writable(skb, optoff + 2 + hdr-&gt;opt_len))<br /> goto drop;<br /> <br /> /* Trace pointer may have changed */<br /> trace = (struct ioam6_trace_hdr *)(skb_network_header(skb)<br /> + optoff + sizeof(*hdr));<br /> <br /> ioam6_fill_trace_data(skb, ns, trace, true);<br /> <br /> ioam6_event(IOAM6_EVENT_TRACE, dev_net(skb-&gt;dev),<br /> GFP_ATOMIC, (void *)trace, hdr-&gt;opt_len - 2);<br /> <br /> If the skb is cloned or lacks sufficient linear headroom,<br /> skb_ensure_writable() will invoke pskb_expand_head(), which reallocates<br /> the skb&amp;#39;s data buffer and frees the old one, invalidating pointers to<br /> it. While the code recalculates the trace pointer immediately after the<br /> call to skb_ensure_writable(), it fails to recalculate the hdr pointer.<br /> <br /> This patch fixes the above by recalculating the hdr pointer before<br /> passing hdr-&gt;opt_len to ioam6_event(), so that we avoid any UaF.