Kernel memory corruption via concurrent lock rollback

Use-after-free in Linux ksmbd 5.15 through 7.2.5 allows remote authenticated users to corrupt kernel memory via concurrent SMB2 lock requests. The smb2_lock() path publishes a granted lock to shared lists before a multi-element request completes while retaining it on rollback_list. The race requires an authenticated SMB session, a valid tree and file handle, a failing later lock element, and a concurrent UNLOCK; exploitation can crash the host or corrupt kernel memory.