The Linux kernel's MPLS multipath selection function mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop for MPLS routes with multiple nexthops. While processing the MPLS label stack, the hash routine caches a header pointer. After reaching the bottom-of-stack label, pskb_may_pull() is called to ensure the inner IP header is accessible. If the skb is nonlinear with insufficient tailroom, pskb_may_pull() triggers pskb_expand_head(), which replaces the skb head and frees the old one, leaving the cached header pointer dangling and pointing to freed memory. This leads to a use-after-free condition, confirmed by KASAN reports during testing with a Geneve packet through a bareudp/MPLS multipath setup. The vulnerability was fixed by reloading the header pointer from the current skb head after each successful pull before accessing the inner IP header.

The vulnerability causes a use-after-free condition in kernel memory, which can lead to kernel crashes or undefined behavior. While no active exploits are known, the issue can cause system instability or denial of service if triggered. No direct evidence of privilege escalation or code execution is provided in the input data.

A fix has been implemented in the Linux kernel to reload the header pointer after each pskb_may_pull() call to prevent use-after-free. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation. No alternative mitigations or temporary workarounds are indicated.