Linux Kernel EUVD-2026-34106

The bug lives in net/netfilter/nft_inner.c, specifically the nft_inner_parse_l2l3() function, which inspects the inner network/transport headers of tunneled traffic so nftables rules can match on encapsulated payloads. For inner IPv6, the code correctly calls ipv6_find_hdr() to walk all IPv6 extension headers (Hop-by-Hop, Routing, Fragment, Destination Options, etc.) and return the true offset of the transport header, but immediately overwrites that offset with nhoff + sizeof(struct ipv6hdr) - a flat 40-byte assumption that ignores any extension headers present. The result is that inner_thoff points to the first extension header while l4proto still reflects the real transport protocol (e.g., IPPROTO_TCP) discovered by ipv6_find_hdr(), creating an inconsistent parse state that downstream rule evaluation trusts. The non-inner IPv6 path in netfilter does not have this defect, making it a regression localized to inner/tunneled parsing introduced when nft_inner support landed in 6.2. No CWE was assigned in the input, but the root cause class is incorrect calculation/parsing of protocol header offsets leading to security-decision-relevant state mismatch.