CVE-2026-99112: net/sched: cls_flower: validate mask pointer after nla_next()

In the Linux kernel, the following vulnerability has been resolved:

net/sched: clsflower: validate mask pointer after nlanext()

flsetencopt() iterates the key's nested tunnel-option attributes with nlaforeachattr() while advancing a single mask pointer via nlanext() at the bottom of each loop, so the mask cursor is driven by the number of key attributes rather than by the mask's own attributes. The nlaok() added by commit c96adff956191 ("clsflower: call nlaok() before nlanext()") only validates the mask pointer that was just consumed; the pointer produced by nlanext() is used by the next iteration (flsetgeneveopt() and siblings) without any validation.

The mask's nested attributes are validated with NLVALIDATELIBERAL, which merely warns on trailing bytes that do not form a complete attribute. A mask carrying one valid attribute plus 1-3 residue bytes (or a non-aligned attribute length making mskdepth negative) therefore reaches the next iteration with mskdepth != 0, so neither the !mskdepth check in flsetencopt() nor the !depth check in the per-type helpers fires. nlatype() then reads past the mask payload and nlaparsenesteddeprecated() iterates with an nlalen taken from those bytes, reading well beyond the mask attribute (KASAN: slab-out-of-bounds read in nlavalidateparse from flchange()).

Validate the advanced mask pointer as well: when the mask is not legitimately exhausted (mskdepth != 0) and the new pointer fails nlaok(), reject the filter with -EINVAL. An exactly exhausted mask still skips the check, preserving exact-match behaviour for the remaining key attributes.