af_unix: Unlink scc_entry in unix_del_edge()

Hi,

Please consider backporting the following mainline commit to the 6.1.y, 6.6.y, 6.12.y and 6.18.y stable trees:

594d905195024b228c962627ae5ae7c17bd582a4 ("af_unix: Unlink scc_entry in unix_del_edge().")

("af_unix: Replace garbage collection algorithm.", in v6.10)

It fixes CVE-2026-80521, a slab use-after-free in the AF_UNIX garbage
collector: unix_del_edge() moves a vertex to the to-be-freed list without unlinking vertex->scc_entry, so after the kfree the persistent SCC circle still points at freed memory, and the next GC round writes to it. The bug is reachable by an unprivileged user via SCM_RIGHTS fd passing and close().

The fix is a one-liner and applies cleanly; the target block in unix_del_edge() is identical across all four affected series:

  	if (!vertex->out_degree) {
  		edge->predecessor->vertex = NULL;
  		list_move_tail(&vertex->entry, &fpl->vertices);
  +		list_del(&vertex->scc_entry);
  	}

Why these trees: the fix is already in mainline, 7.1.y (>= 7.1.10) and 7.2.y (7.2.6), but is missing from the currently-supported LTS lines. Checked today against the stable tags (net/unix/garbage.c):

fix PRESENT : v7.2.6, v7.1.13
fix MISSING : v6.18.52, v6.12.110, v6.6.157, v6.1.188 (all vulnerable) unaffected : v5.15.221, v5.10.270 (older GC, no SCC rework)

The introducing commit landed in mainline v6.10, but the SCC garbage collector was also backported into two older LTS lines, so the affected supported LTS range is wider than the CVE record's "6.10" suggests:

  6.1.y  : vulnerable from v6.1.145  (v6.1.140 still had the old GC)
  6.6.y  : vulnerable from v6.6.94   (v6.6.92 still had the old GC)
  6.12.y : vulnerable from v6.12     (native, >= 6.10)
  6.18.y : vulnerable from v6.18     (native, >= 6.10)

6.1.y in particular ships in widely deployed distributions.

Verification: I reproduced the UAF on a freshly built v6.18.52 with KASAN (tarball GPG-verified, live build-id attributed):

  BUG: KASAN: slab-use-after-free in __unix_gc
  Write of size 8 ... by task kworker/u8:0   (events_unbound __unix_gc)
  Allocated by: unix_prepare_fpl <- unix_scm_to_skb <- unix_dgram_sendmsg
  Freed by:     kfree <- unix_destroy_fpl <- unix_destruct_scm <- __unix_gc
  kmalloc-96, 40 bytes in (== vertex->scc_entry)

Found during an audit that noticed the deployed 6.18.y LTS carried the vulnerable code without the fix. Reproducer available on request.

Thanks,
David