CVE-2026-98950: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

In the Linux kernel, the following vulnerability has been resolved:

flowdissector: avoid u16 truncation of hlen in bpfflowdissect()

bpfflowdissect() sanitizes the offsets returned by the BPF program with clampt(u16, ..., hlen).

If hlen is bigger than 65535, the upper bound is truncated before the comparison. For instance, with hlen == 65536, both nhoff and thoff are forced to zero, even if the program returned sane values.

This is the same class of bug as the one fixed in commit 99bda1ecbd56 ("flowdissector: avoid u16 truncation of skb->len when computing thoff"). That fix does not cover the BPF path, because skbflowdissect() returns early when a BPF flow dissector handles the packet.

struct bpfflowkeys stores nhoff and thoff as u16, so cap hlen to U16MAX before clamping.

Found by sashiko while reviewing the commit above.