CVE-2026-72248

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: support IPIP tunnel with direct xmit

The combination of IPIP tunnel with direct xmit, eg. bridge device,

breaks because no dst_entry is provided to check the skb headroom and to

set the iph->frag_off field. This leads to invalid dst usage and can

trigger a crash in the tunnel transmit path.

Fix this by moving dstcache and dstcookie out of the runtime union so

that they can be shared by neighbour, xfrm, and direct tunnel flows.

For FLOWOFFLOADXMIT_DIRECT tuples carrying tunnel metadata, preserve

route state in these shared fields and release it through the common

dst release path.

Since dst_entry is now available to the three supported xmit modes and

dst_release() already deals with NULL dst, remove the xmit type check

in nftflowdst_release(). Moreover, skip the check if the dst entry

is NULL in nfflowdst_check() which is now the case for the direct

xmit case.

Based on patch from Rein Wei n05ec@lzu.edu.cn.