UBUNTU-CVE-2026-97599: Low severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: ieee802154: hwsim: serialize pib updates to fix double-free hwsimupdatepib() does an unserialized read-swap-free of phy->pib: pibold = rtnldereference(phy->pib); ... rcuassignpointer(phy->pib, pib); kfreercu(pibold, rcu); It assumes the RTNL is held, but ->setchannel is not always called under it: the mac802154 scan worker changes channels via drvsetchannel() without the RTNL. Such an update can race an RTNL-held one on the same phy; both read the same pibold and both kfreercu() it, double-freeing the object. With SLUB percpu sheaves batching kfreercu(), this surfaces as a KASAN invalid-free in rcufreesheaf(). struct hwsimphy has no lock for pib. Add one and make the swap atomic with rcureplacepointer() under it, dropping the misleading rtnldereference().