UBUNTU-CVE-2026-89917: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle VNCR TLB invalidation race with vcpuput() VNCR unmapping While VNCR TLB invalidation always occurs under the MMU lock, vcpuput() doesn't, while it unmaps the VNCR page. The problem is that the invalidation evaluates vncrtlb::cpu to decide whether an unmapping needs to take place (cpu != -1) before performing it. On the other hand, thiscpuresetvncrfixmap() unconditionally unmaps if L1VNCRMAPPED is set. These two obviously can race, with a TOCTOU pattern on the TLBI path, and a BUGON() on the vcpuput() path. And the two can end-up calling vncrfixmap(-1), with extra lethal effects. Move the reset of vncrtlb::cpu to -1 to a common function, and make this update atomic so that only a single thread can reset the field and perform the corresponding unmap. The vcpuput() still need to unconditionally unmap the current VNCR to close another ugly race. Finally, the assignment of vncrtlb::cpu is moved to be kept in sync with the actual mapping, similar to L1VNCRMAPPED being set.