UBUNTU-CVE-2026-98646: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: tcp: Skip condresched() in inetcsklistenstop() under BPF context bpfsockdestroy() runs from the tcp iterator, under rcureadlock(). If the sock is a listener that still has children in its accept queue, tcpabort() ends up in inetcsklistenstop() and the condresched() there trips the debug check: BUG: sleeping function called from invalid context at net/ipv4/inetconnectionsock.c:1523 inatomic(): 0, irqsdisabled(): 0, nonblock: 0, pid: 628, name: testprogs preemptcount: 0, expected: 0 RCU nest depth: 1, expected: 0 locks held by testprogs/628: 3, last CPU#3: #0: ffff8881158cee18 (&p->lock){+.+.}-{4:4}, at: bpfseqread+0x56/0x1210 #1: ffff8881106bb858 (sklock-AFINET6){+.+.}-{0:0}, at: bpfitertcpseqshow+0x32b/0x4b0 #2: ffffffffb435af20 (rcureadlock){....}-{1:3}, at: bpfiterrunprog+0x46b/0xde0 CPU: 3 UID: 0 PID: 628 Comm: testprogs Tainted: G W 7.2.0+ #65 PREEMPT Tainted: [W]=WARN Call Trace: <TASK> dumpstacklvl+0xc1/0xf0 dumpstack+0x10/0x20 mightresched+0x3d2/0x610 inetcsklistenstop+0x7b/0xbf0 tcpabort+0x23b/0x3b0 bpfsockdestroy+0xfc/0x140 bpfprog448133d24601754fitertcp6server+0x81/0x8a bpfiterrunprog+0x538/0xde0 bpfitertcpseqshow+0x26b/0x4b0 bpfseqread+0x424/0x1210 vfsread+0x197/0xe40 ksysread+0x119/0x240 x64sysread+0x72/0xc0 x64syscall+0x647/0x27e0 dosyscall64+0xe5/0x610 entrySYSCALL64afterhwframe+0x76/0x7e RIP: 0033:0x7fad39b28aca RSP: 002b:00007ffc381c61c0 EFLAGS: 00000246 ORIGRAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007ffc381c6a88 RCX: 00007fad39b28aca RDX: 0000000000000032 RSI: 00007ffc381c6250 RDI: 0000000000000014 RBP: 00007ffc381c61e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 000055f077c1bbb0 R15: 00007fad3a0f3000 </TASK> The commit that added the kfunc already guards locksock() in tcpabort() and udpabort() with hascurrentbpfctx(), but missed the listener path. Do the same for the condresched(). The loop runs inside the iterator's rcureadlock(), it must not reschedule or report a quiescent state there.