UBUNTU-CVE-2026-97984: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork->base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockopt IPV6MTUDISCOVER is set to IPV6PMTUDISCDO or IPV6PMTUDISCPROBE, and a large packet is sent over a netdev with an unusually large MTU. Steps to reproduce (included in the new selftest): 1. Set device MTU bigger than IP6MAXMTU. cork->base.fragsize will be set to that MTU in ip6setupcork. 2. Set IPV6MTUDISCOVER to IPV6PMTUDISCPROBE or IPV6PMTUDISCDO. It lets maxnonfragsize be set to device MTU (cork->fragsize) in ip6appenddata, rather than to IP6MAXMTU. 3. Send 65528 bytes of payload (+8 bytes of UDP header, +40 bytes of IPv6 header). Device MTU allows it (it's only one byte bigger than IP6MAXMTU, and the device MTU is bigger than that). 4. The UDP length in the built packet is 65536, which overflows the 16-bit length field and triggers the WARN in udpsetlenshort. To avoid breaking sending UDP jumbograms over raw IPv6 sockets, limit the change to UDP sockets only. The original overflow bug with IPv6 and IPV6PMTUDISCDO seems to predate git history (verified reproduction on 2.6.21), was fixed later, and then reappeared in commit 427faee167bc ("net: ipv6: introduce ip6dstmtumaybeforward"), which is chosen as the Fixes tag here. The overflow with IPV6PMTUDISCPROBE reproduces since its introduction in commit 628a5c561890 ("[INET]: Add IP(V6)PMTUDISCRPOBE").