After patching CVE-2026-98625, verify the kernel not just the package

CVE‒2026 8625 is a local‑use‑after‑free vulnerability in the Linux netfilter flowtable offload code. Ubuntu rates it as low privilege required, high attack complexity, and no user interaction. An attacker must have local control to influence network flow lifecycle, trigger a race condition during destroy work, and cause a memory corruption. The fix involves changing when destroy work publishes NF_FLOW_HW_DEAD.