ipv6 LwtunnelXmit UAF

Vulnerability analysis

When the IPv6 output path sends a packet through a lightweight tunnel, it caches a pointer to the destination address in the IPv6 header before calling the tunnel transmit function. The tunnel transmit path (LWT-BPF or other encapsulation) can reallocate the packet buffer to add encapsulation headers, freeing the memory the cached pointer references. After the tunnel function signals that the packet should continue through normal output processing, the code still uses the stale pointer to compute the next hop and look up the neighbour entry, resulting in a use-after-free read. The fix re-reads the IPv6 header pointer from the potentially reallocated packet after the tunnel transmit function returns, so all subsequent next-hop and neighbour operations reference valid memory. An unprivileged local user can trigger this by creating a user network namespace where they hold CAP_NET_ADMIN, configuring a lightweight tunnel route, and sending IPv6 traffic through it; the stale read can disclose kernel data, corrupt the neighbour cache, or panic the kernel.