UBUNTU-CVE-2026-98568: High severity ubuntu/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate() samples LLRESERVEDSPACE() to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink() can update neededheadroom between the two reads, creating a TOCTOU race. The second value can exceed the allocation and make the Ethernet header write out of bounds. The race is reproducible on the unpatched kernel. It occurred when vxlannacreate() generated a neighbour reply while vxlanchangelink() changed the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte skbuffsmallhead allocation. Snapshot the headroom once and use that value for both allocation and reservation.