CVE-2026-98699: wifi: mac80211: fix mesh fast xmit path deletion UAF

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix mesh fast xmit path deletion UAF

meshfasttxcache() stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu(), but a lookup that already holds the path can insert a new cache entry after the flush. The cache then points at freed memory.

Set MESHPATHDELETED before flushing, and skip inserting a cache entry if the path or MPP path is already deleted. Check this under the cache walk lock so it is ordered with the flush. Use WRITEONCE() for the deletion flag updates because the cache check reads flags without taking statelock.