Local privilege escalation via mountpoint lifetime races

Race condition in the Linux kernel allows local users to gain kernel privileges by racing MNT_TREE_BENEATH mount operations. In do_lock_mount, the code releases mount_lock without jointly retaining the parent mount and dentry, allowing concurrent move or unmount activity to tear down the filesystem before inode_lock uses those objects; unlock_mount also releases the dentry pin too early. An ordinary local user can obtain the required namespace-scoped capability and retry the race, producing use-after-free primitives for kernel-memory access and control-flow hijacking or causing a kernel panic.