Local denial of service via untracked poll requests

Resource leakage in Linux 6.0 through 6.1.6 allows local users to stall io_uring ring exit through crafted poll requests. The __io_arm_poll_handler function returned after a ready edge-triggered one-shot poll request could not finish inline without inserting the request into the internal poll hash, making the request unreachable and leaking it. Successful triggering requires local low-privileged access to create io_uring poll requests and win the relevant poll race; the bounded consequence is a hang during ring teardown rather than data disclosure or modification.