CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv()

In the Linux kernel, the following vulnerability has been resolved:

net/iucv: take a reference on the socket found in afiucvhsrcv()

afiucvhsrcv() looks up the destination socket under iucvsklist.lock, drops the lock, and then passes the socket to the afiucvhscallback() handlers without holding a reference. AFIUCV sockets are not RCU-protected and are freed synchronously by iucvsockkill() -> sockput(), so a concurrent close can free the socket in the window between readunlock() and the handler, which then dereferences freed memory (for example sk->skdataready() in afiucvhscallbacksyn()).

Take a reference with sockhold() while the socket is still on the list and release it with sockput() once the handler has run.