CVE-2026-72450: xfrm: validate selector family and prefixlen during match

In the Linux kernel, the following vulnerability has been resolved:

xfrm: validate selector family and prefixlen during match

syzbot reported a shift-out-of-bounds in xfrmselectormatch() due to AFUNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when XFRMSTATEAFUNSPEC is set).

Fix this by:

- Rejecting mismatched families in xfrmselectormatch. - Returning false in addr4match if prefixlen > 32. - Returning false in addrmatch if prefixlen > 128 (prevents overflow).