CVE-2026-74543: net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()

In the Linux kernel, the following vulnerability has been resolved:

net: udptunnel: fix memory leak in udptunnelnicunregister()

syzbot reported a memory leak [1] in the UDP tunnel NIC offload code.

When device registration fails (e.g. in registernetdevice()), netdev core unwinds by sending a single NETDEVUNREGISTER notification. If work was queued during NETDEVREGISTER (utn->workpending is set), udptunnelnicunregister() returns early:

if (utn->workpending) return;

Because failed registrations do not enter netdevwaitallrefsany(), no subsequent NETDEVUNREGISTER rebroadcast will ever occur. As a result, the struct udptunnelnic allocated in udptunnelnicalloc() is leaked permanently.

Fix this by removing the early return. Instead, synchronously cancel any pending work with canceldelayedworksync() before freeing @utn.

To be able to call canceldelayedworksync() while holding RTNL (the work also needs RTNL), switch udptunnelnicdevicesyncwork() to rtnltrylock(). If RTNL is contended, requeue the work with a 1 jiffy delay (via queuedelayedwork()) to prevent high CPU contention while waiting for RTNL lock.

The utn->workpending bookkeeping is no longer needed and is removed, as the workqueue core already tracks the pending/running state of the work.

[1] BUG: memory leak unreferenced object 0xffff888127d5f840 (size 96): comm "syz-executor", pid 5806, jiffies 4294942188 backtrace (crc 99fdb6c8): kmallocnoprof+0x3bf/0x550 udptunnelnicalloc net/ipv4/udptunnelnic.c:756 [inline] udptunnelnicregister net/ipv4/udptunnelnic.c:833 [inline] udptunnelnicnetdeviceevent+0x804/0xab0 net/ipv4/udptunnelnic.c:931 notifiercallchain+0x59/0x160 kernel/notifier.c:85 callnetdevicenotifiersinfo+0x7d/0xb0 net/core/dev.c:2250 registernetdevice+0xc10/0xeb0 net/core/dev.c:11478