CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure

In the Linux kernel, the following vulnerability has been resolved:

lockd: Plug nlmfile refcount leak on cached nlmdofopen() failure

The cached-file path in nlmlookupfile() reaches the found: label unconditionally, even when nlmdofopen() fails. At that label result and file->fcount are updated before the error is returned. The wrappers nlm3svclookupfile() and nlm4svclookupfile() then bail out of their switch without copying result back to their caller, so the proc handler's local nlmfile pointer remains NULL and the cleanup path skips nlmreleasefile(). The fcount increment is never released, and nlmtraversefiles() can no longer reap the file because its refcount never returns to zero between requests.

Short-circuit the cached path so neither result nor fcount is touched when nlmdofopen() fails on a hashed nlmfile.