In the Linux kernel, the following vulnerability has been resolved:

vxlan: re-fetch eth header after route shortcircuit()

Before route shortcircuit(), the eth header pointer is cached from eth hdr(skb).

Inside route shortcircuit(), pskb may pull() can be called, which may reallocate skb->head.

In this case, returning to vxlan xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h dest.

Fix this by updating eth = eth hdr(skb) after calling route shortcircuit().