Linux Kernel CVE-2026-72250

The defect lives in net/netfilter/nf_conntrack_reasm.c within the nf_ct_frag6_reasm() function, part of the netfilter IPv6 connection-tracking reassembly subsystem introduced in Linux 2.6.15. After reassembling IPv6 fragments, the function slides the packet head forward to strip the IPv6 fragment extension header (frag_hdr, 8 bytes), then unconditionally applies skb->mac_header += sizeof(struct frag_hdr). The mac_header field of Linux's sk_buff structure is a u16 offset whose sentinel value (u16)~0U (0xFFFF) signals 'not set', tested by skb_mac_header_was_set(). On the NF_INET_LOCAL_OUT defrag hook - invoked for locally originated packets - no link-layer header has been attached yet, so mac_header holds the 0xFFFF sentinel. Adding 8 wraps the unsigned 16-bit arithmetic: 0xFFFF + 8 = 0x10007, truncated to u16 = 7. Subsequent calls to skb_mac_header_was_set() erroneously return true, and skb_mac_header() returns a pointer 7 bytes before the network header, well inside kernel headroom. The parallel IPv6 reassembler in net/ipv6/reassembly.c correctly guards this adjustment with a skb_mac_header_was_set() check; the netfilter variant failed to mirror that guard. No CWE is formally assigned by NVD, but the root cause class is a missing boundary/sentinel check leading to integer wraparound and subsequent out-of-bounds pointer use within the kernel networking stack.