CVE-2026-89555 mpls: reload header after pskb_may_pull()

In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskbmaypull mplsselectmultipath calls mplsmultipathhash to choose a nexthop when an MPLS route has multiple nexthops. While walking the MPLS label stack, the hash routine caches hdr for the current label...

CVE-2026-89555

Linux kernel MPLS multipath selection (mpls_select_multipath) contains a slab-use-after-free vulnerability. When mpls_multipath_hash() walks the MPLS label stack, it caches a header pointer (hdr). If pskb_may_pull() subsequently triggers pskb_expand_head() to replace the skb head, the cached poin...