CVE-2026-98623: drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate

If listforeachentry() exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead.

The check is reachable from userspace: nvkmclkustateupdate() takes the pstate id straight from the 'pstate' debugfs file, so requesting an id that is not in clk->states - or any id at all when the perf tables are broken and the list is empty - makes the pstate->pstate != req test dereference the list head cast to a struct nvkmpstate, which is an out-of-bounds read.

[Francesco: rebased on drm-misc-next, expanded the commit message]