io_uring: fix task_work add use-after-free with SQPOLL

{
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "io_uring/io_uring.c",
                        "io_uring/tw.c"
                    ],
                    "versions": [
                        {
                            "version": "af5d68f8892f8ee8f137648b79ceb2abc153a19b",
                            "lessThan": "42b3332efacfd2140be4cd0dedad4fb96b8ae90e",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "af5d68f8892f8ee8f137648b79ceb2abc153a19b",
                            "lessThan": "891bd8335a0de3bb15c3b797ce3026bbb0dbef6c",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "af5d68f8892f8ee8f137648b79ceb2abc153a19b",
                            "lessThan": "395b25968fe854d4efaa19a8e9b7a5b6d1b3eea3",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "af5d68f8892f8ee8f137648b79ceb2abc153a19b",
                            "lessThan": "a92193c91e8839fe5fc209616ea95465ae4b919d",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                }

{
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "io_uring/io_uring.c",
                        "io_uring/tw.c"
                    ],
                    "versions": [
                        {
                            "version": "6.9",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.9",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.113",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.56",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.2.10",
                            "lessThanOrEqual": "7.2.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.3",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }