UBUNTU-CVE-2026-98801: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: net: restrict SORESERVEMEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 ("net: add new socket option SORESERVEMEM") and commit d00c8ee31729 ("net: fix possible NULL deref in sockreservememory") only checked skhasaccount(sk), which is true for both TCP and UDP sockets. However, SORESERVEMEM and skunusedreservedmem() are currently only supported by TCP: - On UDP sockets, sk->skforwardalloc is protected by sk->skreceivequeue.lock, whereas sockreservememory() and sockreleasereservedmemory() only acquire locksock(sk). Concurrent UDP packet reception/release and setsockopt(SORESERVEMEM) corrupt skforwardalloc and memcg accounting. - udprmemrelease() reclaims excess skforwardalloc without accounting for skunusedreservedmem(sk). Restrict sockreservememory() to TCP sockets (skistcp(sk)) for now. Supporting SORESERVEMEM for UDP (acquiring skreceivequeue.lock and honoring skunusedreservedmem() in udprmemrelease()) can be done in a future net-next series if needed. In addition, reject val > SZ1G with -EINVAL in sksetsockopt(SORESERVEMEM). Without an upper bound, values near INTMAX cause skmempages(delta) and (pages << PAGESHIFT) to overflow 32-bit signed int, corrupting sk->skforwardalloc and sk->skreservedmem. Using a page-aligned cap (SZ1G) ensures that the page-rounded sk->skreservedmem reported by getsockopt(SORESERVEMEM) can always be passed back to setsockopt(SORESERVEMEM).