CVE-2026-64525: xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit

In the Linux kernel, the following vulnerability has been resolved:

xfrm: move policybydst RCU sync from per-netns .exit to .preexit

The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers:

Exit methods using blocking RCU primitives, such as synchronizercu(), should be implemented via exitbatch. [...] Please, avoid synchronizercu() at all, where it's possible.

Note that a combination of preexit() and exit() can be used, since a synchronizercu() is guaranteed between the calls.

xfrmpolicyfini() violates this: it calls synchronizercu() before freeing the policybydst hash tables (so no RCU reader is mid- traversal at free time), but runs from xfrmnetops.exit -- once per namespace -- so a cleanupnet() of N namespaces pays N full RCU grace periods serially.

Use the documented preexit/exit split. Move the policy flush (and the workqueue drains it depends on) into a new .preexit handler; xfrmpolicyfini() then runs in .exit and frees the hash tables after the synchronizercuexpedited() that cleanupnet() guarantees between the two phases. Providing O(1) RCU grace periods per batch instead of O(N).

Observed on Linux 6.18 with a workload doing unshare(CLONENEWNET) at ~13/sec sustained: cleanupnet() and the netnswq rescuer kthread both stuck in xfrmpolicyfini()'s synchronizercu(), >300k struct net accumulated in the cleanup queue, Percpu in /proc/meminfo climbed to 130+ GB on 256-CPU hosts, and memcg OOMs followed. setupnet and putnet counts were balanced, ruling out a refcount leak.