CVE-2026-98541: fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT

In the Linux kernel, the following vulnerability has been resolved:

fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT

Commit 7a9bc9e3f423 ("fou: Don't allow 0 for FOUATTRIPPROTO.") added NLAPOLICYMIN(NLAU8, 1) to founlpolicy[FOUATTRIPPROTO], which rejects an explicitly supplied FOUATTRIPPROTO == 0 attribute with -ERANGE.

However, FOUATTRIPPROTO is an optional netlink attribute. When a user sends FOUCMDADD with FOUATTRTYPE set to FOUENCAPDIRECT and omits FOUATTRIPPROTO entirely, nlapolicy validation succeeds and parsenlconfig() leaves cfg->protocol as 0 (from memset(cfg, 0, sizeof(cfg))). foucreate() then creates a FOUENCAPDIRECT socket with fou->protocol == 0.

In fouudprecv(), returning -fou->protocol to udpqueuercvoneskb() triggers IP protocol resubmission when fou->protocol > 0, whereas returning 0 tells the UDP tunnel layer that the skb was consumed without freeing it. When fou->protocol == 0, every packet received on the socket returns 0 from fouudprecv() and leaks the skbuff.

Reject FOUENCAPDIRECT when !cfg->protocol in foucreate() so that creating a direct encapsulation port without FOUATTRIPPROTO fails with -EINVAL while leaving FOUCMDDEL and FOUCMDGET (which share parsenlconfig()) unaffected.

Tested in QEMU against Linux 7.3.0-rc3 by sending a FOUCMDADD Generic Netlink request with FOUATTRPORT = 5555 and FOUATTRTYPE = FOUENCAPDIRECT while omitting FOUATTRIPPROTO. On the unfixed kernel, FOUCMDADD succeeds (err = 0), FOUCMDGET reports fou->type = 1 and fou->protocol = 0, and sending 4000 UDP packets to 127.0.0.1:5555 leaks all 4000 skbuffs (SUnreclaim in /proc/meminfo grows from 41456 kB to 59008 kB, +17552 kB); with this patch applied, FOUCMDADD is rejected with -EINVAL (-22).