CVE-2026-98804: net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()

In the Linux kernel, the following vulnerability has been resolved:

net: pagepool: fix use-after-free in pagepoolrecycleringbulk()

With CONFIGPAGEPOOLSTATS=y, pagepoolrecycleringbulk() updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, pagepoolrelease() can pass its producer-lock barrier and free the pool before recyclestatadd() runs.

Commit fcc680a647ba7 ("pagepool: allow mixing PPs within one bulk") moved this stat update after the unlock. Commit 271683bb2cf32 ("pagepool: Fix use-after-free in pagepoolrecycleinring") later added the barrier, but only fixed pagepoolrecycleinring(). Move the update back under the lock.