CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag

nfctfrag6reasm() slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb->macheader:

skb->macheader += sizeof(struct fraghdr);

On the NFINETLOCALOUT defrag path the skb has no link-layer header yet, so skb->macheader is still the "not set" sentinel (u16)~0U. Adding sizeof(struct fraghdr) wraps it to a small value (0xffff + 8 == 7), after which skbmacheaderwasset() wrongly reports a MAC header is present and skbmacheader() points into the headroom.

The reassembler has done this unconditional add since it was introduced; it was harmless while macheader was a bare pointer, but wrong once macheader became a u16 offset whose unset state is the ~0U sentinel tested by skbmacheaderwasset(). The sibling net/ipv6/reassembly.c does the same relocation and does guard the adjustment; mirror the guard here.