The Linux kernel contained a use-after-free vulnerability in the UDP tunnel segmentation function __skb_udp_tunnel_segment(). This function accessed the UDP header pointer before ensuring the tunnel header was present in the socket buffer (skb) head. If the pull operation caused skb->head to be reallocated, the previously saved UDP header pointer became invalid, potentially leading to memory corruption. The vulnerability was fixed by changing the code to get the UDP header after the pull, thus avoiding the use of a stale pointer.

This vulnerability could cause memory corruption due to use-after-free, which may lead to kernel crashes or potentially allow an attacker to execute arbitrary code in kernel context. However, no known exploits in the wild have been reported. The impact is limited to affected Linux kernel versions where this code pattern existed.

A fix has been implemented in the Linux kernel source code to address this use-after-free issue by adjusting the order of operations in __skb_udp_tunnel_segment(). Users should apply the official kernel updates or patches that include this fix. Since no vendor advisory or patch links are provided here, users should monitor official Linux kernel release notes or trusted security advisories for the patch and update accordingly.