ipv6 JumboHop StalePointer

Vulnerability analysis

The vulnerability is a stale pointer in ip6_parse_tlv() in net/ipv6/exthdrs.c. While processing IPv6 hop-by-hop extension headers, the function calls ipv6_hop_jumbo() to handle the IPV6_TLV_JUMBO option. Inside that helper, pskb_trim_rcsum() may reallocate or modify the socket buffer's data pointers. After ipv6_hop_jumbo() returns, the local 'nh' pointer (obtained earlier via skb_network_header()) may reference freed or relocated memory. Any subsequent use of 'nh' constitutes a use-after-free / memory-corruption primitive against attacker-reachable heap objects (the old skb buffer). The fix refreshes 'nh' by calling skb_network_header(skb) immediately after ipv6_hop_jumbo() returns. The attack surface is fully network-reachable: an unauthenticated remote attacker can send a specially crafted IPv6 packet with a Jumbo Payload option to trigger this path on any system with IPv6 enabled.