[PATCH 6.6.y 0/2] CVE-2025-38060: backport fix series

[Artem Dinaburg]

Hi,

Please consider this backport series for CVE-2025-38060 to 6.6.y.

Apply the patches in this order:
1. bpf: copy_verifier_state() should copy 'loop_entry' field (fix)
2. bpf: abort verification if env->cur_state->loop_entry != NULL (correction)

Patch 1 preserves loop_entry when copying verifier state, keeping cloned
loop states consistent with their originals.

Patch 2 aborts verification with -EFAULT when loop_entry is unexpectedly
set instead of clearing the pointer and continuing with corrupted state.
The code changes in both patches are identical to upstream.

The complete fix is already present in 6.12.y, 6.18.y and 7.2.y.

Build-tested only as part of a cumulative 6.6.y series on x86_64
(allmodconfig, CONFIG_WERROR=y); no runtime testing.

An LLM assisted with preparing these backports.

Thanks,
Artem Dinaburg