In the Linux kernel, the following vulnerability has been resolved:

vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

skb_tunnel_check_pmtu() can change skb->head.

Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.

Use instead ip_hdr(skb) as done in drivers/net/bareudp.c
and drivers/net/geneve.c.

Found by Sashiko.

https://git.kernel.org/stable/c/5303925e360527243b46a440a04667826bbc72b7

https://git.kernel.org/stable/c/609e63312c29aad18026a1d3222e123d4b6b0feb

https://git.kernel.org/stable/c/6b8bfce9d2f774d2c2243e0248e03efb99bba6c0

https://git.kernel.org/stable/c/7d9ef0cb271555d8cf39fefe6c981e1493b25ecf

https://git.kernel.org/stable/c/8d435d68d71fb875876b722f4136caf74f2f48bd

https://git.kernel.org/stable/c/9257f56ac47ef1976bcd056cf986a9988eeec67a

https://git.kernel.org/stable/c/a493efd4336cf19122ae0e4cbb3d31b32d70deea

https://git.kernel.org/stable/c/dc3bfa050f873371e745bdf478b1f5b738e5733d

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/vxlan/vxlan_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4cb47a8644cc9eb8ec81190a50e79e6530d0297f","lessThan":"6b8bfce9d2f774d2c2243e0248e03efb99bba6c0","versionType":"git","status":"affected"},{"version":"4cb47a8644cc9eb8ec81190a50e79e6530d0297f","lessThan":"9257f56ac47ef1976bcd056cf986a9988eeec67a","versionType":"git","status":"affected"},{"version":"4cb47a8644cc9eb8ec81190a50e79e6530d0297f","lessThan":"8d435d68d71fb875876b722f4136caf74f2f48bd","versionType":"git","status":"affected"},{"version":"4cb47a8644cc9eb8ec81190a50e79e6530d0297f","lessThan":"dc3bfa050f873371e745bdf478b1f5b738e5733d","versionType":"git","status":"affected"},{"version":"4cb47a8644cc9eb8ec81190a50e79e6530d0297f","lessThan":"609e63312c29aad18026a1d3222e123d4b6b0feb","versionType":"git","status":"affected"},{"version":"4cb47a8644cc9eb8ec81190a50e79e6530d0297f","lessThan":"5303925e360527243b46a440a04667826bbc72b7","versionType":"git","status":"affected"},{"version":"4cb47a8644cc9eb8ec81190a50e79e6530d0297f","lessThan":"a493efd4336cf19122ae0e4cbb3d31b32d70deea","versionType":"git","status":"affected"},{"version":"4cb47a8644cc9eb8ec81190a50e79e6530d0297f","lessThan":"7d9ef0cb271555d8cf39fefe6c981e1493b25ecf","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/vxlan/vxlan_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.9","status":"affected"},{"version":"0","lessThan":"5.9","versionType":"semver","status":"unaffected"},{"version":"5.10.259","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]