Idaifish

The issue allows local users to cause a denial of service, resulting in a system crash due to a divide-by-zero error in the ` tcp select window` function. This occurs when a disconnect is triggered within a certain `tcp recvmsg` code path.

The issue is related to a NULL pointer dereference in the Linux kernel, specifically in the net/ipv4/route.c file. This allows local users to cause a denial of service or possibly have other unspecified impacts via crafted system calls. The problem is associated with errors in pointer handling.

The issue is related to the ` ip6 append data` function in the Linux kernel, which is too late in checking whether an overwrite of an skb data structure may occur. This allows local users to cause a denial of service (system crash) via crafted system calls.