net/ipv6 IOAM6 Overflow

Vulnerability analysis

The vulnerability occurs in ioam6_fill_trace_data() where the schema length contribution is stored in a u8 variable. With bit 22 enabled and the maximum schema payload of 1020 bytes, the calculation 1 + 1020/4 = 256 overflows the u8 range and wraps to 0, bypassing the remaining-space check. __ioam6_fill_trace_data() then positions the write cursor without reserving the schema area but still copies the 4-byte schema header and the full schema payload, resulting in an out-of-bounds write beyond the trace buffer. The fix changes sclen to unsigned int so the bounds check and cursor calculation both use the true length. Exploitation requires IPv6 IOAM6 to be configured with a vulnerable schema, but the overflow can be triggered by remote IPv6 packets without privileges or user interaction.