UBUNTU-CVE-2026-98284: Medium severity ubuntu/linux-aws vulnerability

In the Linux kernel, the following vulnerability has been resolved: netlink: do not free nlk->groups while lockless readers can use it netlinkreallocgroups() uses krealloc() under netlinktablegrab(). Whenever NLGRPSZ(groups) lands in a different kmalloc bucket, the old bitmap is freed immediately. Two readers of nlk->groups / nlk->ngroups do not hold the netlink table lock: 1) skdiagdumpgroups(). Hashed (bound) sockets are dumped from the rhashtable walk in netlinkdiagdump(), which only holds RCU. Only the mclist part of the dump takes nltablelock. 2) netlinknativeseqshow() (/proc/net/netlink), whose walk has been lockless since commit 21e4902aea80 ("netlink: Lockless lookup with RCU grace period in socket release"). Both can read a freed buffer, and skdiagdumpgroups() can also read past the end of the old (smaller) buffer if it happens to load the old @groups pointer together with the new @ngroups value, copying the result into a NETLINKDIAGGROUPS attribute. This is the same class of bug that commit f773608026ee ("netlink: access nlk groups safely in netlink bind and getname") fixed for bind() and getname(); these two readers were missed. Simply grabbing the table lock in skdiagdumpgroups() is not an option, because it is also called with nltablelock already held from the mclist section of the dump. Make the lockless readers safe instead: - Allocate a new bitmap and free the old one after an RCU grace period, instead of relying on the implicit kfree() done by krealloc(). - Publish @groups before @ngroups, both with release semantics, and have the lockless readers load @ngroups first. A reader can then never pair the new (bigger) size with the old (smaller) buffer, and a reader picking up the new pointer while still seeing the old size is guaranteed to see the initialized bitmap. netlinkreallocgroups() is called from process context (bind() and setsockopt()), so kfreercumightsleep() can be used, once the table has been released.