[PATCH 6.6.y 0/2] CVE-2026-22996, CVE-2026-23035: backport fix series

[Artem Dinaburg <artem@trailofbits.com>]

Hi,

Please consider this backport series for CVE-2026-22996, CVE-2026-23035 to
6.6.y.

Apply the patches in this order:
1. net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (fix)
2. net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (fix)

Patch 1 stores the netdev for suspend, resume and removal so cleanup
survives a cleared private-state pointer. The older removal path obtains
the hardware device from the auxiliary device and unregisters once:
binding follows successful registration, and the target profile changes
keep that registration.

Patch 2 destroys the stored netdev without relying on priv->netdev, which
profile rollback can clear. Its code changes are identical to upstream.
Apply both patches after the pending 6.6.y backport of 3d5918477f94
(net/mlx5e: Fix netif state handling), which fixes registration-failure
cleanup.

The complete fix is already present in 6.12.y, 6.18.y and 7.2.y.

Build-tested only as part of a cumulative 6.6.y series on x86_64
(allmodconfig, CONFIG_WERROR=y), changed objects only; no runtime testing.

An LLM assisted with preparing these backports.

Thanks,
Artem Dinaburg