Stable kernels need alternate fix for AF_UNIX UAF

A use-after-free in Linux AF_UNIX stream sockets, tracked as CVE-2026-64109, remains open on long-term stable kernels even after mainline closed it a different way.

The flaw sits in the path that waits for stream data: the code peeks the tail of the receive queue and then reads that packet's length without holding the queue lock. A concurrent change can free the packet underneath the reader. The bug has been present since stream sockets gained splice support years ago, so it reaches 6.1, 5.15, and 5.10.

Mainline eliminated the length read entirely. That change is documented as unsuitable before 6.5, leaving the stable trees exposed. Jamie Bainbridge proposed a stable-only approach that takes the receive queue lock around the peek and length check, matching the pattern already used when sending pages on the same sockets, then drops the lock promptly.

Stable maintainer Sasha Levin has asked AF_UNIX maintainer Kuniyuki Iwashima to confirm the locking is correct for 6.1 and older before the fix is queued, and has requested separate variants because the change does not apply cleanly to 5.15 or 5.10.