CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nftfib: reject fib expression on the netdev egress hook

A fib expression in a netdev egress base chain dereferences nftin(pkt), NULL on the transmit path, causing a NULL pointer dereference at eval. nftfibvalidate() masks the hook with NFINET values, but netdev hook numbers are a separate enum that aliases them (NFNETDEVEGRESS == NFINETLOCALIN), so an egress chain passes validation and then faults.

Add nftfibnetdevvalidate() that limits each result/flag to the netdev hook where the device it reads exists: the input-device cases (OIF, OIFNAME, ADDRTYPE with FIIF) to ingress, the output-device case (ADDRTYPE with FOIF) to egress, ADDRTYPE with no device flag to both. Also restrict nftfibvalidate() to NFPROTOIPV4/IPV6/INET so its NFINET masks are not applied to another family's hooks.