Override CVE-2013-4127 to reference the proper upstream fix

There appear to be two commits which point to the same patch in
Linus' tree:
dd7633ecd553a5e304d349aa6f8eb8a0417098c5
and
c38e39c378f46f00ce922dd40a91043a9925c28d

I can't explain how this happened yet, but the stable commit references
c38e39c and that's also the commit which shows up if you look at the
log for drivers/vhost/net.c so using that going forward.