CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache corruption

tcfpeditact() builds a rough writable prefix from tcfpoffmaxhint before the action mutates any packet bytes.

Since 6c02568fd1ae, TCP and UDP keys recompute their L4 base from the current L3 header inside the key loop. An earlier key can therefore change a later header-relative base and make the final store land outside the initially ensured prefix, where it can fall back to skbstorebits() on skb frags.

Keep the initial estimate as a fast path, but grow the ensured writable range from each key's final computed write offset before loading or storing the edited word.

— Red Hat