Kernel memory corruption via premature msg_ring request freeing

Use-after-free in the Linux kernel's io_uring message-ring path allows local users to corrupt kernel state through crafted ring activity. msg_ring requests can be freed while deferred task work on another ring still references them because the requests bypass RCU-delayed reclamation. An unprivileged local user or container can create both rings and control the race, enabling kernel-memory disclosure, corruption, a task stall, or a kernel panic.