udp TunnelSegment UAF

Vulnerability analysis

When the kernel splits UDP tunnel traffic into smaller segments, it records the UDP header location before making sure all tunnel header data is held in the main packet buffer. If the kernel later rearranges that buffer to pull in the tunnel header, the recorded location may point to memory that has been freed. The stale pointer is then used when computing checksums, causing a use-after-free. The fix changes the order of operations so the UDP header is located only after the buffer is guaranteed to be stable. This path is reached whenever traffic passes through an already-configured UDP tunnel such as VXLAN or GENEVE and requires software segmentation; it can be triggered by remote forwarded traffic or by local traffic sent through the tunnel interface, with no special privileges required of the sender.