UBUNTU-CVE-2026-90359: Low severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject >8 byte return values on return-reading trampoline paths btfdistillfuncproto() builds the function model used for the fentry/fexit/fmodret/fsession trampolines and structops. It has accepted a 16-byte int128 return value since the trampoline was introduced: gettypesize() returns the integer's type size, and the return-type check only rejected ret < 0. But the BPF trampoline preserves only 8 bytes of the return value (RAX on x86, i.e. R0). For an attach type that reads the target's return value the second half (RDX / R3) is neither saved nor restored, so a program attached to a function returning a 16-byte value corrupts the value seen by the real caller and itself observes only half of it. structops trampolines have the same limitation. This affects the attach types that read the target's return value: fexit, fmodret and fsession (plus the multi variants of fexit and fsession), and structops. fentry/fentrymulti run before the target returns and are unaffected. Reject a >8 byte return value for these attach types in bpfcheckattachtarget() and bpfcheckattachbtfidmulti(), and for structops in bpfstructopsdescinit().