CVE-2026-72126: can: isotp: use unconditional synchronize_rcu() in isotp_release()

In the Linux kernel, the following vulnerability has been resolved:

can: isotp: use unconditional synchronizercu() in isotprelease()

isotpnotify() unregisters the (RCU) CAN filters via canrxunregister() and clears so->bound without waiting for a grace period. isotprelease() uses so->bound to decide whether it needs to call synchronizercu() before cancelling so->rxtimer, so when NETDEVUNREGISTER runs first it skips that synchronizercu() and can cancel the timer while an in-flight isotprcv() is still executing and about to re-arm it via isotpsendfc(), leading to a use-after-free timer callback on the freed socket.

sakisho-bot remarked a problem with rtnllock held in isotpnotify(), therefore make isotprelease() always call synchronizercu() before cancelling the timers, regardless of so->bound. This still closes the original race (isotpnotify() clearing so->bound without waiting for in-flight isotprcv() callers before isotprelease() cancels the RX timer) without adding any RCU wait to the netdevice notifier path.