CVE-2026-23298 can: ucan: Fix infinite loop from zero-length messages