CVE-2026-98621: net: gue: reject invalid REMCSUM offsets

In the Linux kernel, the following vulnerability has been resolved:

net: gue: reject invalid REMCSUM offsets

The REMCSUM option carries an absolute checksum start and checksum field offset. gueremcsum() passes them to skbremcsumprocess(), whose partial path stores offset - start in the u16 skb->csumoffset variable. If offset is less than start, this underflows.

A forwarded packet can retain CHECKSUMPARTIAL and reach a NETIFFHWCSUM driver which trusts the metadata, leading skbcopyandcsumdev() to write two bytes about 64 KiB beyond the destination buffer.

Reject reversed tuples in validategueflags(), after the existing length validation, so all GUE parsers enforce the ordering in one place.