UBUNTU-CVE-2026-98596: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6routeoutputflags(), ip6rtputflags(), and ip6dstcheck() detect an uncached route by listempty(&rt->dst.rtuncached), which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 ("net: remove DSTNOCACHE flag"). When a device is unregistered, rt6uncachedlistflushdev() unlinks uncached routes tied to the device from rt6uncachedlist. Previously, they were moved to another list with listmove() (listdelentry() + listadd()), and since commit 98aa546af5e4 ("inet: remove (struct uncachedlist)->quarantine"), the routes are just unlinked with listdelinit(). If listdelinit() runs concurrently, listempty() evaluates to true; ip6routeoutputflags() calls dstholdsafe() incorrectly and ip6rtputflags() skips ip6rtput(), leaking dst, and thus dev tied via rt->from as well. The same race is partially fixed by commit 9a6f0c4d5796 ("dst: fix races in rt6uncachedlistdel() and rtdeluncachedlist()"). Let's check rt6->dst.rtuncachedlist instead. Note that IPv4 does not have the same issue.