Linux kernel packet fanout use-after-free in packet_release() via NETDEV_UP race

CVE-2026-31504 is a Linux kernel networking vulnerability in AF_PACKET fanout handling. In packet_release(), there is a race window during socket teardown where a concurrent NETDEV_UP notifier can re-register the socket into a fanout group's arr[] array. Before the fix, packet_release() released bind_lock without first zeroing po->num, so po->num remained non-zero and po->ifindex could still match the bound device. If packet_notifier(NETDEV_UP) had already located the socket in sklist, it could re-link the socket. For fanout sockets this path invokes __fanout_link(sk, po), which adds the socket back into the fanout group's f->arr[] and increments f->num_members, but does not increment f->sk_ref. Because fanout_release() does not clean up this re-registration, the fanout array can retain a dangling pointer to a freed socket, resulting in a use-after-free condition. The upstream fix prevents the race by setting po->num to zero while bind_lock is still held in packet_release().