CVE-2026-23074: Add CVSS 3.1 score (7.8 HIGH)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AV:L -This vulnerability is exploited via tc/netlink (RTM_NEWQDISC)
    to configure qdiscs, which requires local access through the
    netlink socket interface.
AC:L -The attacker controls the entire setup: creating the QFQ root
    with teql child, sending packets, and triggering the class change
    after netem delay. All sides of the race are attacker-controlled,
    making exploitation reliable.
PR:L -Configuring qdiscs requires CAP_NET_ADMIN, but
    netlink_net_capable() checks against the network namespace's
    user_ns, so an unprivileged user can obtain this capability via
    user namespaces (unshare -Urn).
UI:N -No user interaction is required; the attacker sets up the
    qdisc hierarchy, sends packets, and triggers the UAF entirely on
    their own.
S:U -The vulnerability results in kernel memory corruption within
    the same security context (kernel space). There is no crossing of a
    virtualization or sandbox boundary.
C:H -The use-after-free allows the attacker to control freed object
    contents via heap spraying, enabling arbitrary kernel memory reads.
I:H -The use-after-free enables heap spraying and arbitrary write
    primitives, which can be leveraged for control flow hijacking and
    kernel code execution.
A:H -The use-after-free causes kernel crashes (accessing dangling
    pointers) and can result in kernel panics, providing high
    availability impact.

Signed-off-by: Sasha Levin <sashal@kernel.org>