netfilter ip6tables ExtHdr Bypass

Vulnerability analysis

The IPv6 netfilter extension header matches for AH, Hop-by-Hop, and Routing headers check that the fixed header is present and then derive the advertised length from a header field. When the advertised length exceeds the remaining packet data, the match reports a rule mismatch without marking the packet for drop. A mismatch result tells the firewall the rule did not apply, so a rule intended to drop packets carrying these extension headers is skipped and the malformed packet continues through the firewall table. The fix marks malformed packets for immediate drop before reporting a mismatch and adds the missing length check for the AH match, ensuring malformed extension headers are dropped rather than treated as non-matching. The vulnerable path is reached when processing incoming IPv6 packets on a host with ip6tables rules using these extension header matches, requiring no special privileges from the attacker.