Kernel memory corruption via cached_fid bitfield race

Race condition in the Linux Kernel SMB client allows remote attackers to corrupt kernel memory after a crafted SMB share is mounted. Concurrent updates to is_open, has_lease, and on_list in struct cached_fid perform shared-byte read-modify-write operations that can restore cleared flags and corrupt reference or list state. Reachability requires a user or administrator to mount the attacker's SMB share; the resulting stale state can cause use-after-free, arbitrary kernel reads or writes, code execution, or a kernel panic.