Kernel memory corruption via wrong THP queue lock

Race condition in the Linux kernel allows local users to corrupt kernel memory or halt affected systems through transparent huge-page pressure. During swapout, mem_cgroup_swapout clears folio->memcg_data before removing a THP from its deferred split list, so later cleanup uses the pgdat lock instead of the list's memcg lock. An unprivileged local process can race partial THP unmapping with memory pressure when memory cgroups are enabled, causing a panic, hard lockup, or cross-context memory access.