Cross-namespace hangs via FUSE-stalled directory reads

Lock misuse in Linux 7.1 nullfs allows local users to hang other empty mount namespaces through crafted directory reads. iterate_dir() holds the shared inode lock while getdents() copies directory entries into a buffer whose page fault an attacker-controlled FUSE server stalls. Access to an empty mount namespace and a controlled FUSE mount is required; queuing mkdir() behind the reader blocks other users' uncached lookups, creates, and mounts on that directory until the server responds.