CVE-2026-23276 net: add xmit recursion limit to tunnel xmit functions