CVE-2026-72429

In the Linux kernel, the following vulnerability has been resolved:

ipv6: ioam: fix type confusion of dst_entry

IOAM uses a dummy dstentry(nulldst) to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dstcacheset_ip6().

However, the IPv6 dst cache path eventually calls rt6getcookie(), which treats the dstentry as part of a struct rt6info. Since the nulldst was embedded directly as a struct dstentry in struct ioam6lwt, this resulted in an invalid cast and rt6get_cookie() reading fields from the wrong object.

In practice, the wrong cookie is not used while dst->obsolete is zero, but rt6getcookie() may also access per-cpu value when rt->sernum is zero. In this case, rt->sernum aliases ioam6lwt::cache::resetts, which can become zero, making this a potential invalid pointer access.

Fix this by embedding a full struct rt6_info for the dummy IPv6 route and passing its dst member to the dst APIs.