CVE-2026-98596: ipv6: Fix dst leak for uncached routes.

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix dst leak for uncached routes.

ip6routeoutputflags(), ip6rtputflags(), and ip6dstcheck() detect an uncached route by listempty(&rt->dst.rtuncached), which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 ("net: remove DSTNOCACHE flag").

When a device is unregistered, rt6uncachedlistflushdev() unlinks uncached routes tied to the device from rt6uncachedlist.

Previously, they were moved to another list with listmove() (listdelentry() + listadd()), and since commit 98aa546af5e4 ("inet: remove (struct uncachedlist)->quarantine"), the routes are just unlinked with listdelinit().

If listdelinit() runs concurrently, listempty() evaluates to true; ip6routeoutputflags() calls dstholdsafe() incorrectly and ip6rtputflags() skips ip6rtput(), leaking dst, and thus dev tied via rt->from as well.

The same race is partially fixed by commit 9a6f0c4d5796 ("dst: fix races in rt6uncachedlistdel() and rtdeluncachedlist()").

Let's check rt6->dst.rtuncachedlist instead.

Note that IPv4 does not have the same issue.