CVE-2026-99040: KEYS: Fix add_key() race with keyring restriction

In the Linux kernel, the following vulnerability has been resolved:

KEYS: Fix addkey() race with keyring restriction

keycreateorupdate() snapshots keyring->restrictlink before taking the destination keyring's semaphore. keyringrestrict() installs a restriction while holding that semaphore.

This allows a writer to observe no restriction, wait for the keyring owner to install a reject-all restriction and return successfully, and then link a key using the stale NULL snapshot. The writer only needs write permission on the destination keyring.

Move the restrictlink read after keylinklock() and keylinkbegin(). The read and the subsequent restriction check are then serialized with restriction installation by keyring->sem.

The race was reproduced on v7.2.8 in 19 executions where restriction installation returned before the link completed. All 19 linked the key despite the reject-all restriction. With this change, 312 executions reached the same ordering and every addkey() call failed with -EPERM.

The issue was found by manual concurrency analysis assisted by AI-based analysis and independently verified with a QEMU reproducer and kernel instrumentation.