In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag

nf_ct_frag6_reasm() slides the packet head forward to drop the IPv6
fragment header and then unconditionally advances skb->mac_header:

	skb->mac_header += sizeof(struct frag_hdr);

On the NF_INET_LOCAL_OUT defrag path the skb has no link-layer header
yet, so skb->mac_header is still the "not set" sentinel (u16)~0U. Adding
sizeof(struct frag_hdr) wraps it to a small value (0xffff + 8 == 7),
after which skb_mac_header_was_set() wrongly reports a MAC header is
present and skb_mac_header() points into the headroom.

The reassembler has done this unconditional add since it was introduced;
it was harmless while mac_header was a bare pointer, but wrong once
mac_header became a u16 offset whose unset state is the ~0U sentinel
tested by skb_mac_header_was_set(). The sibling net/ipv6/reassembly.c
does the same relocation and does guard the adjustment; mirror the
guard here.

https://git.kernel.org/stable/c/00bdce2fda7e430d24cfbc96764a1b96deb31f82

https://git.kernel.org/stable/c/2a95ec21824a8ad81ad660b12231456fc0ac9830

https://git.kernel.org/stable/c/3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9

https://git.kernel.org/stable/c/53ef70a315420ed31581d38343684b3bf9a3c76d

https://git.kernel.org/stable/c/6e8cd710ca35c576f5f2e5a396047c9ac61f75e5

https://git.kernel.org/stable/c/a58230f3a7c4f6c3261786bc1efb72c42e68cd25

https://git.kernel.org/stable/c/bbcdef2061b170af45702ce6b359c02c12acfc94

https://git.kernel.org/stable/c/cd0d7bbc027b4d3329712cdcdeb4e5567ffd0d58

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/netfilter/nf_conntrack_reasm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1","lessThan":"6e8cd710ca35c576f5f2e5a396047c9ac61f75e5","versionType":"git","status":"affected"},{"version":"9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1","lessThan":"2a95ec21824a8ad81ad660b12231456fc0ac9830","versionType":"git","status":"affected"},{"version":"9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1","lessThan":"bbcdef2061b170af45702ce6b359c02c12acfc94","versionType":"git","status":"affected"},{"version":"9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1","lessThan":"cd0d7bbc027b4d3329712cdcdeb4e5567ffd0d58","versionType":"git","status":"affected"},{"version":"9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1","lessThan":"53ef70a315420ed31581d38343684b3bf9a3c76d","versionType":"git","status":"affected"},{"version":"9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1","lessThan":"a58230f3a7c4f6c3261786bc1efb72c42e68cd25","versionType":"git","status":"affected"},{"version":"9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1","lessThan":"00bdce2fda7e430d24cfbc96764a1b96deb31f82","versionType":"git","status":"affected"},{"version":"9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1","lessThan":"3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/netfilter/nf_conntrack_reasm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.15","status":"affected"},{"version":"0","lessThan":"2.6.15","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]