CVE-2026-68127

The CVE describes a slab-use-after-free in the Linux kernel’s ila_update_ipv6_locator() triggered by a non-linear skb and pskb_may_pull() in the csum_adjust_transport path. The root cause is that ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before pskb_may_pull(), and __pskb_pull_tail(...