Kernel disruption via NBD configuration race

Use-after-free in the Linux kernel NBD subsystem allows local users to disrupt kernel availability through a configuration race. In nbd_genl_connect, the configuration mutex is released before NBD_RT_HAS_CONFIG_REF is set and config_refs is incremented, allowing concurrent NBD_CLEAR_SOCK and close operations to drop the reference count to zero first. Reaching the race requires CAP_SYS_ADMIN and concurrent connection, socket-clearing, and device-close operations; the published reproducer reports a refcount use-after-free warning rather than data disclosure or modification.