UBUNTU-CVE-2026-98402: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: net: icmp: avoid invalid transport header access in icmpsend tracepoint syzbot reported a WARNING triggered by DEBUGNETWARNONONCE(): WARNING: at skbtransportheader include/linux/skbuff.h:3087 [inline] WARNING: at udphdr include/linux/udp.h:23 [inline] WARNING: at dotraceeventraweventicmpsend include/trace/events/icmp.h:30 [inline] WARNING: at traceeventraweventicmpsend+0x48c/0x6ec include/trace/events/icmp.h:11 Call trace: skbtransportheader include/linux/skbuff.h:3087 [inline] udphdr include/linux/udp.h:23 [inline] dotraceeventraweventicmpsend include/trace/events/icmp.h:30 [inline] traceeventraweventicmpsend+0x48c/0x6ec include/trace/events/icmp.h:11 traceitericmpsend include/trace/events/icmp.h:11 [inline] dotraceicmpsend include/trace/events/icmp.h:11 [inline] traceicmpsend+0x320/0x49c include/trace/events/icmp.h:11 icmpsend+0xcfc/0x11d8 net/ipv4/icmp.c:1013 ipv4senddestunreach net/ipv4/route.c:1280 [inline] ipv4linkfailure+0x57c/0x8dc net/ipv4/route.c:1287 dstlinkfailure include/net/dst.h:438 [inline] vtitunnelxmit+0xe40/0x17a4 net/ipv4/ipvti.c:307 TPfastassign() unconditionally calls udphdr(skb) before checking whether the packet is UDP. Furthermore, icmpsend() can be invoked from paths (e.g., link failures, ARP errors, forwarding, AFPACKET) where skb->transportheader was never initialized (~0U). Under CONFIGDEBUGNET=y, calling skbtransportheader(skb) triggers DEBUGNETWARNONONCE(!skbtransportheaderwasset(skb)). Fix this by: 1. Only parsing transport info when iph->protocol == IPPROTOUDP. 2. Using skbheaderpointer() at skbnetworkoffset(skb) + (iph->ihl << 2) to safely fetch the UDP header without assuming transportheader is set.