Kernel compromise via stale NVMe request queue

Use-after-free in the Linux kernel NVMe host driver allows local users to compromise the kernel through a retained admin descriptor. Controller teardown frees the admin request_queue before namespace-held controller references are released, so blk_queue_enter accesses reclaimed queue memory. A local user with NVMe device access can retain a namespace or controller descriptor across teardown and trigger information disclosure, memory corruption, or a system crash without winning a narrow race.