CVE-2026-74314: bpf: Cancel special fields on map value recycle

In the Linux kernel, the following vulnerability has been resolved:

bpf: Cancel special fields on map value recycle

Map update and delete paths currently call bpfobjfreefields() when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete operation. For tracing programs this can include NMI context, where referenced kptr destructors, uptr unpinning, and graph root destruction are not generally safe.

Introduce bpfobjcancelfields() for the reusable-value path. It only performs NMI-safe cleanup for timer, workqueue, and taskwork fields. Fields that need full destruction are left attached to the recycled value and are destroyed by the final cleanup path instead.

Switch array and hashtab update/delete/recycle paths to this cancel helper. Keep bpfobjfreefields() for final map destruction and for bpfmemalloc destructors. Preallocated hashtabs do not have allocator destructors, so teardown continues to walk the normal and extra elements and fully destroy their fields.

This deliberately relaxes the eager-free semantics of map update/delete for special fields. Programs that relied on a recycled map slot becoming empty immediately after update/delete were relying on behavior that cannot be implemented safely from every BPF execution context without offloading arbitrary destructors.

There is a chance this change breaks programs making assumptions regarding the eager freeing of fields. If so, we can relax semantics to cancellation only when irqsdisabled() is true in the future. However, theoretically, map values that get reused eagerly already have weaker guarantees as parallel users can recreate freed fields before the new element becomes visible again.