Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski [off-list ref]:

On Thu, 25 Jun 2026 09:47:01 +0200 you wrote:

The tag_8021q.c tagger calls vlan_insert_tag() in dsa_8021q_xmit().
vlan_insert_tag() will consume the skb with kfree_skb() on failure
and return NULL.

When NULL is returned as error code to ->xmit() in dsa_user_xmit()
it will free the same skb again leading to a double-free.

[...]

Here is the summary with links:
  - [net,v5] net: dsa: Fix skb ownership in taggers
    https://git.kernel.org/netdev/net/c/d4be5f6f9094

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html