Local restriction bypass via premature exec cleanup

Security restriction bypass in Linux kernel 7.0 allows local users to create unrestricted io_uring rings after exec. During exec cancellation, io_uring_cancel_generic calls __io_uring_free, which releases io_uring_restrict together with the task context instead of retaining the restriction. The process must first install per-task restrictions and use io_uring; after exec, it can create a ring outside those restrictions, so the consequence is limited to operations that the discarded policy had blocked.