A null pointer dereference in Linux kernel that affects multiple kernel versions.

The bug is in "rawv6_push_pending_frames" function in net/ipv6/raw.c.
According to Herbert Xu, who fixed the bug, the root cause is that
"total_len = inet_sk(sk)->cork.base.length" in this function also
counts the length of the extension header (+ the amount of valid data
in the socket cork queue). In the vulnerable version of the function,
it directly uses the length as the amount of data in the cork queue.
In the following code:

    struct sk_buff *csum_skb = NULL;
    ...
    skb_queue_walk(&sk->sk_write_queue, skb) {
        ...
        if (offset >= len) {
            offset -= len;
            continue;
        }
        csum_skb = skb;
    }
    skb = csum_skb;

If the `offset` is larger than the amount of data in the socket cork
queue but smaller than valid data length + extension header length,
then the loop shown above will always enter the "if (offset >= len)"
branch. As a result, csum_skb will never be set. Consequently, the
final skb variable will be set to NULL.

Null dereference happens in the following "skb_transport_offset(skb);" call.