CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: fix listdel corruption in kfdcriuresumesvm

The cleanup tail of kfdcriuresumesvm() walks svms->criusvmmetadatalist and kfree()s each struct criusvmmetadata without removing it from the list. The list head is left pointing at freed kmalloc-96 objects.

A second AMDKFDIOCCRIUOP from the same process re-enters: listempty() reads the dangling ->next (use-after-free), the loop walks freed entries, and each is kfree()'d again (double-free). This is reachable by an unprivileged render-group user via /dev/kfd with no capabilities required.

Add listdel() before the kfree() so the list is properly emptied. The listforeachentrysafe() iterator already caches the next pointer, so unlinking during the walk is safe.

(cherry picked from commit 6322d278a298e2c1430b9d2697743d3a04b788b1)