Kernel code execution via SMB response double put

Use-after-free in Linux 6.6.32 through 6.6.50 and 6.9 through 6.10.9 allows remote attackers to execute kernel code via SMB. In smb2_rename_path(), smb2_compound_op() drops cfile after an -EINVAL response, but the caller reuses the stale reference instead of reacquiring a writable path, causing a second put that frees an open file object. A malicious or compromised SMB server, or man-in-the-middle attackers where signing or encryption is not enforced, can trigger kernel-memory disclosure, arbitrary writes, a kernel panic, or kernel code execution during an open-file rename.