UBUNTU-CVE-2025-38591: Medium severity ubuntu/linux-azure vulnerability

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = (u8 )(r1 + 169); exit; With pointer field sk being at offset 168 in skbuff. This access is detected as a narrower read in bpfskbisvalidaccess because it doesn't match offsetof(struct skbuff, sk). It is therefore allowed and later proceeds to bpfconvertctxaccess. Note that for the "isnarrowerload" case in the convertctxaccesses(), the insn->off is aligned, so the cnt may not be 0 because it matches the offsetof(struct skbuff, sk) in the bpfconvertctxaccess. However, the targetsize stays 0 and the verifier errors with a kernel warning: verifier bug: error during ctx access conversion(1) This patch fixes that to return a proper "invalid bpfcontext access off=X size=Y" error on the load instruction. The same issue affects multiple other fields in context structures that allow narrow access. Some other non-affected fields (for skmsg, sklookup, and sockopt) were also changed to use bpfctxrangeptr for consistency. Note this syzkaller crash was reported in the "Closes" link below, which used to be about a different bug, fixed in commit fce7bd8e385a ("bpf/verifier: Handle BPFLOADACQ instructions in insndefregno()"). Because syzbot somehow confused the two bugs, the new crash and repro didn't get reported to the mailing list.