nf_tables UAF fix headed to Linux 6.12, 6.6, and 6.1 stables

A use-after-free in Linux nf_tables netdev event handling is being backported to the 6.12, 6.6, and 6.1 longterm kernels. Newer trees from 6.18 onward are already clear of the bug after a broader netdev-hook rework.

The flaw hits when the last interface tied to a netdev-family base chain is unregistered. Releasing that base chain can deactivate a jump into a binding chain, free the successor, and leave the event walker's saved pointer dangling. The result is a slab use-after-free in the netdev notifier path. Yu Junzhe reported the issue, confirmed it under KASAN on an unpatched 6.6 guest, and noted it still present on current 6.12, 6.6, and 6.1 stable lines.

The practical trigger is an anonymous jump (the kind that marks a chain as binding) added after the base chain is already committed, followed by deletion of the bound device while the network namespace is still alive. The path needs CAP_NET_ADMIN and is not the same race as full netns teardown.

Upstream, Phil Sutter fixed the behavior by keeping netdev-family chains alive when their last interface vanishes, aligning them with flowtable handling and avoiding the destructive release during the walk. A follow-up simplified the notifier so ordinary list iteration is safe once chains are no longer deleted from that path. The change also helps operators who dump rulesets on shutdown and restore them later: they no longer lose the chain and its rules solely because the last device disappeared.

Those two commits do not land as a straight cherry-pick of the full rework on the older stables, so Yu supplied series tailored for 6.12 and for 6.6/6.1, tested under KASAN with the original anonymous-jump ruleset. Greg Kroah-Hartman asked for working, tested patches and said the stable trees would review and apply them if they pass.