CVE-2026-23362 can: bcm: fix locking for bcm_op runtime updates