CVE-2026-98983: unshare: don't drop active namespace references that were never taken

In the Linux kernel, the following vulnerability has been resolved:

unshare: don't drop active namespace references that were never taken

Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switchtasknamespaces() and copynamespaces() and dropped again by putnsproxy() through deactivatensproxy().

But ksysunshare() calls putnsproxy() on an nsproxy that was never installed when setcreducounts() fails. The new namespaces of that nsproxy go from zero to minus one and the namespaces shared with the caller lose a reference that belongs to the nsproxy the caller keeps using:

WARNING: kernel/nscommon.c:171 at nsrefactiveput+0x1cd/0x230 nsproxynsactiveput deactivatensproxy ksysunshare

Afterwards the namespaces the caller lives in aren't listed by listns() anymore. setcreducounts() only fails when allocucounts() can't allocate and it only allocates when the real uid of the caller differs from its effective uid.

Commit cefd55bd2159 ("nsproxy: fix freensproxy() and simplify createnewnamespaces()") separated the two cases on purpose. nsproxyfree() frees an nsproxy that was prepared but never installed and that's what a failed setns() uses in putnsset(). Export it and use it for a failed unshare() as well.