UBUNTU-CVE-2026-80845: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: xfrm: avoid lock inversion in nat keepalive work natkeepalivework() walks the state table while xfrmstatewalk() holds net->xfrm.xfrmstatelock. Its callback then acquires x->lock, which conflicts with the delete path taking the same locks in reverse order via xfrmstatedelete() and xfrmstatedelete(). This creates an AB-BA deadlock that is reported by lockdep when a NAT keepalive worker races with SA deletion. Fix this by splitting the keepalive walk into two phases. First, collect the candidate states while the walk holds xfrmstatelock and take a reference on each state. Then, after the walk completes, process each collected state and acquire x->lock without nesting it under xfrmstatelock.