Linux kernel BPF verifier incorrect state pruning due to atomic fetch precision tracking

CVE-2026-43009 is a flaw in the Linux kernel BPF verifier's backtracking logic, specifically in backtrack_insn handling of BPF_STX instructions that use BPF_ATOMIC together with BPF_FETCH. For atomic fetch operations, the source register, or r0 in the BPF_CMPXCHG case, is not only an input operand but also a destination that receives the old value from memory. The prior verifier logic treated these instructions like ordinary stores and failed to propagate precision tracking to the corresponding stack slot. As a result, the stack location was not marked precise, and later verifier path-pruning could incorrectly conclude that two verifier states were equivalent even when their stack states differed. The fix extends BPF_LDX-style handling in backtrack_insn to atomic fetch instructions via is_atomic_fetch_insn(), clears the tracked fetch destination register when appropriate, and propagates precision to the stack slot. For non-stack memory, precision tracking stops at the atomic instruction as with regular BPF_LDX.