melange: Incomplete package integrity verification allows data section substitution (CVE-2026-54174) | HOL Guard CVE