CVE-2026-98570: net: ipv6: keep room for the mac header in dst_dev_overhead()

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: keep room for the mac header in dstdevoverhead()

The seg6, ioam6 and rpl lwtunnels size their skbcowhead() request as the length they are about to push plus dstdevoverhead(), then push the new headers and rebuild the mac header below them with skbmacheaderrebuild(). That rebuild needs skb->maclen of headroom, but dstdevoverhead() leaves LLRESERVEDSPACE() of the egress device, 16 bytes for plain Ethernet.

Where the mac header is longer than that, as it is on ingress through a VLAN device with reorderhdr off, the rebuild runs out of room: skbsetmacheader(skb, -skb->maclen) computes a negative offset, stores it unchecked in the u16 skb->macheader, and the memmove that follows writes skb->maclen bytes about 64 KB past skb->head. Forwarding plain ping6 traffic through such a device reproduces it on all five seg6 encapsulation modes and on the rpl and ioam6 inline paths; skb->macheader comes back as 65534 on a 704-byte head.

Return the larger of the two. The helper already returns skb->maclen when it has no dst, so this only makes the other branch agree, and it covers every caller rather than each call site in turn.