CVE-2026-98531: ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: enforce exact attribute length for SEG6ATTRDST

In seg6genlpolicy, SEG6ATTRDST is defined with .type = NLABINARY and .len = sizeof(struct in6addr). For NLABINARY, .len only enforces the maximum payload length and permits shorter payloads (e.g., 0 bytes). When seg6genlsettunsrc() copies sizeof(struct in6addr) bytes via kmemdup(val, sizeof(val), GFPKERNEL), a short SEG6ATTRDST attribute triggers a 16-byte out-of-bounds read past skb->tail into uninitialized skb->head memory, which is stored in sdata->tunsrc and leaked back to userspace via SEG6CMDGETTUNSRC.

Switch SEG6ATTRDST in seg6genlpolicy to NLAPOLICYEXACTLEN(sizeof(struct in6addr)) so that generic netlink validation rejects any attribute whose length is not exactly sizeof(struct in6addr) with -ERANGE.

Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6CMDSETTUNSRC Generic Netlink message with a 0-byte SEG6ATTRDST attribute followed by SEG6CMDGETTUNSRC. On the unfixed kernel, SEG6CMDSETTUNSRC succeeds (err = 0) and SEG6CMDGETTUNSRC leaks 16 bytes of uninitialized kernel heap memory (tunsrc = 836a61ecc4d25a1042a8d60411cfb378); with this patch applied, SEG6CMDSETTUNSRC is rejected by netlink policy validation with -ERANGE (-34) and tunsrc remains zeroed.