Kernel panic via wrong device header check

A traffic-control flaw in affected Linux Kernel releases allows local users to trigger a panic through mixed-device block redirection. In tcf_blockcast_redir(), the loop sends through dev_prev but queries mac_header_xmit on the next device, causing tcf_mirred_to_dev() to push or pull the MAC header with an incorrect length and exhaust socket-buffer headroom. Exploitation requires local low-privilege access and a traffic-control block containing mixed device types; the bounded consequence is a host crash rather than data disclosure or modification.