CVE-2026-72429

In the Linux kernel, the following vulnerability has been resolved:

ipv6: ioam: fix type confusion of dst_entry

IOAM uses a dummy dstentry(nulldst) to mark that the destination should

not be changed after the transformation. This dst is stored in the IOAM lwt

state and may be passed to dstcacheset_ip6().

However, the IPv6 dst cache path eventually calls rt6getcookie(), which

treats the dstentry as part of a struct rt6info. Since the null_dst was

embedded directly as a struct dstentry in struct ioam6lwt, this resulted

in an invalid cast and rt6getcookie() reading fields from the wrong

object.

In practice, the wrong cookie is not used while dst->obsolete is zero, but

rt6getcookie() may also access per-cpu value when rt->sernum is

zero. In this case, rt->sernum aliases ioam6lwt::cache::resetts, which

can become zero, making this a potential invalid pointer access.

Fix this by embedding a full struct rt6_info for the dummy IPv6 route and

passing its dst member to the dst APIs.