Local privilege escalation via stale net_device reference

Use-after-free in Linux kernel SMC networking code 4.19 through 6.17.2 allows local users to corrupt kernel memory during connect. smc_pnet_find_ism_resource and smc_pnet_find_roce_resource pass a destination net_device to __pnet_find_base_ndev without retaining it, so concurrent device teardown frees it before dereference. An unprivileged local user can control the race from a user and network namespace, enabling kernel memory disclosure or corruption, privilege escalation, or a kernel panic.