Shigeru Yoshida

The issue is related to a buffer overflow in the `tipc udp addr2str()` function in the Linux kernel's TIPC (Transparent Inter Process Communication) protocol implementation. This can occur when an invalid UDP media address is provided, potentially leading to a buffer overflow access in `tipc media addr printf()`. The vulnerability may allow an attacker to impact the confidentiality, integrity, and availability of protected information.

The issue is related to a potential uninit-value access in the ` ip6 make skb()` function. To avoid a race condition, the code now checks `FLOWI FLAG KNOWN NH` on `fl6->flowi6 flags` instead of testing `HDRINCL` on the socket. This change was made to fix a potential vulnerability, similar to a fix made for IPv4 in commit `fc1092f51567`.

The issue is related to the crypto component of the Linux kernel, specifically with the algif hash function. When a zero-length message is hashed by algif hash and an error is triggered, it attempts to free an SG list that was never allocated. This can lead to a denial of service. The error occurs due to a bug in the zero-length error path, where the SG list is freed unnecessarily.