CVE-2026-99072: ipv4: stop route notification sizing when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved:

ipv4: stop route notification sizing when nexthop group shrinks

Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added an RCU-only fibnlmsgsize() call for asynchronous hardware flag notifications.

fibnlmsgsize() checks fibinfonumpath() before each iteration, then fibinfonhc() independently reloads nh->nhgrp. If RTMNEWNEXTHOP replaces a group with fewer paths between those loads, fibinfonhc() returns NULL and fibnexthopnlmsgsize() dereferences it.

Stop sizing when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path.