CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq()

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix addrwqtimer race in sctpfreeaddrwq()

sctpfreeaddrwq() previously removed addrwqtimer using timerdelete() while holding addrwqlock. However, timerdelete() does not guarantee that a currently running timer handler has completed.

This allows a race with sctpaddrwqtimeouthandler(), where the handler may still run after addrwaitq has been freed, acquire addrwqlock, and access freed memory, leading to a use-after-free.

Fix this by calling timershutdownsync() before taking addrwqlock. This guarantees that any in-flight timer handler has finished and prevents the timer from being re-armed during teardown, making subsequent cleanup safe.