AZL-96570

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix addrwqtimer race in sctpfreeaddr_wq()

sctpfreeaddrwq() previously removed addrwqtimer using timerdelete() while holding addrwqlock. However, timer_delete() does not guarantee that a currently running timer handler has completed.

This allows a race with sctpaddrwqtimeouthandler(), where the handler may still run after addrwaitq has been freed, acquire addrwq_lock, and access freed memory, leading to a use-after-free.

Fix this by calling timershutdownsync() before taking addrwqlock. This guarantees that any in-flight timer handler has finished and prevents the timer from being re-armed during teardown, making subsequent cleanup safe.