UBUNTU-CVE-2026-97985: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: afunix: Update last skb marker in manageoob(). Fahad Alharbi reported that blocking recv(MSGPEEK) could hog CPU due to OOB skb. In the following cases, manageoob() skips OOB skb(s) and returns NULL for the last recv(MSGPEEK): socketpair(AFUNIX, SOCKSTREAM, 0, sk); 1) skb -> OOB skb -> NULL send(sk[0], "ab", 2, MSGOOB); recv(sk[1], buf, 0, MSGPEEK); 2) skb -> consumed OOB skb -> NULL send(sk[0], "ab", 2, MSGOOB); recv(sk[1], buf, 1, MSGOOB); recv(sk[1], buf, 0, MSGPEEK); 3) consumed OOB skb -> OOB skb -> NULL send(sk[0], "a", 1, MSGOOB); recv(sk[1], buf, 0, MSGOOB); send(sk[0], "b", 1, MSGOOB); recv(sk[1], buf, 1, MSGPEEK); Then, @copied is 0 in unixstreamreadgeneric() (zero-length buffer, or non-OOB skb is not yet consumed), and unixstreamdatawait() is called. However, it returns immediately because @last is not updated in unixstreamreadgeneric(), and the thread busy-waits for a new skb. Let's update @last in manageoob(). For MSGPEEK, @last is updated with the skipped OOB, and for the non-peek case, @last matches the returned value (when !copied) because OOB is unlinked. Note that manageoob() is inlined and no stack canary is added.