The Linux kernel's ip6_tnl_xmit() function previously used skb_realloc_headroom() to expand headroom for outer IPv6 and optional encapsulation headers. This approach replaced the original skb with a new one stored only in a local variable, which is unsafe if subsequent error exits occur because callers still hold the original skb pointer. This could cause double freeing of skb memory when callers free the skb on error. The vulnerability is addressed by switching to skb_cow_head(), which provides the needed headroom and writability without replacing the caller-owned skb, preventing stale pointer issues and double frees. Ethernet users ip6gretap and ip6erspan already used skb_cow_head(), making the IPv6 tunnel path consistent with ip_tunnel_xmit().

The vulnerability could lead to kernel memory corruption due to double freeing of socket buffers in the IPv6 tunnel transmission path. This can cause system instability or crashes. There is no indication of active exploitation in the wild. The fix prevents these unsafe memory operations, improving kernel stability and security.

A fix has been implemented in the Linux kernel source code to replace skb_realloc_headroom() with skb_cow_head() in ip6_tnl_xmit(). Users should update to a kernel version that includes this patch once available. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.