In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix possible UAF in ip6finishoutput2()
If skbexpandhead() returns NULL, skb has been freed and associated dst/idev could also have been freed.
We need to hold rcureadlock() to make sure the dst and associated idev are alive.
[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56efc253196751ece1fc535a5b582be127b0578a",
        "target": {
            "function": "ip6_finish_output2",
            "file": "net/ipv6/ip6_output.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2024-44986-12298175",
        "digest": {
            "length": 1890.0,
            "function_hash": "49718131387904561023120391849651489642"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56efc253196751ece1fc535a5b582be127b0578a",
        "target": {
            "file": "net/ipv6/ip6_output.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2024-44986-145343c5",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "97905526152581316876487329038857868827",
                "123653553621697858308923049385631115521",
                "182546476865057967605226512197121560898",
                "65694474675897883303721001681094282929",
                "72732502892304147641823736729557836370",
                "70087406208886077017706713541135687320",
                "184383395642671063628825897526171204662",
                "209790684962821841804594798697590526594",
                "229228336253034589320711983420402904643"
            ]
        },
        "signature_type": "Line"
    }
]