CVE-2026-98589: bpf: Reject pkt arguments in mutating subprogs

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject pkt arguments in mutating subprogs

The verifier tracks changes in how PTRTOPACKET registers' bounds are modified across subprog boundaries. PTRTOPACKET registers are actually passed as PTRTOMEM, which is assumed valid for the entire call. This is not the case with packet memory, where a pskb call may invalidate its memory region.

Reject BPF code that passes PTRTOPACKET pointers to subprogs that may mutate a packet. We cannot pass the pointer as a true PTRTOPACKET because we would also need to somehow pass the PTRTOPACKETMETA or PTRTOPACKETEND to the subprog. Since we cannot avoid representing the pointer in the subprog as PTRTOMEM, only permit it if the subprog is guaranteed not to mutate the packet.