Local service hang via unlocked configfs list traversal

A race in Linux netconsole 6.9 through 6.17.7 allows local users to hang a kernel operation through concurrent configfs changes. The update_userdata() and count_extradata_entries() paths traverse userdata_group.cg_children without holding su_mutex, so concurrent list_del_init() can leave the iterator cycling on a self-linked node. Exploitation requires low-privileged local access and dynamic netconsole configfs operations; the demonstrated consequence is a nonterminating kernel list walk rather than data disclosure or modification.