Local privilege escalation via io-wq exit race

Use-after-free in Linux kernel 5.13 through 5.15.10 allows local users to gain kernel privileges through io_uring syscalls. During io-wq shutdown, worker-creation task_work can be queued after exit has canceled pending creations, leaving a freed io_worker reachable. An unprivileged local user can control both sides of the race by submitting asynchronous work while closing the ring, causing kernel memory corruption, privilege escalation, or a system crash or hang.