CVE-2026-74275: cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach()

In the Linux kernel, the following vulnerability has been resolved:

cxl/region: Fix out-of-bounds access in cxlcancelautoattach()

In cxlcancelautoattach(), it assumes cxled->pos is a valid index for accessing p->targets[]. However, cxled->pos can be set to negative errno in cxlregionsorttargets() if cxlcalcinterleavepos() fails. This causes the driver to use a negative index to access p->targets[], resulting in out-of-bounds access.

Fix it by walking p->targets[] instead of using cxled->pos directly.