vxlan PMTU UAF

Vulnerability analysis

The root cause is that vxlan_xmit_one() caches the IP header pointer as old_iph before calling skb_tunnel_check_pmtu(), which can reallocate skb->head (e.g., via pskb_expand_head). After this reallocation, old_iph points to freed memory. The stale pointer is then passed to ip_tunnel_ecn_encap() in two code paths (IPv4 and IPv6 outer encapsulation). This constitutes a use-after-free on a heap object. The fix replaces old_iph with ip_hdr(skb), which recomputes the header pointer from the current skb->head, consistent with how bareudp.c and geneve.c handle the same pattern. The attack surface is network-reachable: an attacker can send crafted packets through a VXLAN tunnel endpoint that trigger PMTU processing, causing the skb reallocation and subsequent UAF. No authentication or privileges are required from the network perspective, though the system must be configured as a VXLAN endpoint.