CVE-2026-53341: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()

In the Linux kernel, the following vulnerability has been resolved:

fhandle: fix UAF due to unlocked ->mntns read in maydecodefh()

maydecodefh() accesses mount::mntns without holding any locks; that means the mount can concurrently be unmounted, and the mntnamespace can concurrently be freed after an RCU grace period.

This race can happens as follows, assuming that the mount point was created by opentree(..., OPENTREECLONE):

thread 1 thread 2 RCU dosysopenbyhandleat dohandleopen handletopath maydecodefh ismounted [mount::mntns access] [mount::mntns access] dosysclose fputclosesync fput dissolveonfput umounttree classnamespaceexcldestructor namespaceunlock freemntns mntnstreeremove callrcu(mntnsreleasercu) mntnsreleasercu mntnsrelease kfree [mntnamespace::userns access] UAF

Fix it by taking rcureadlock() around the mount::mntns access, like in prependpath(). Additionally, document the semantics of mount::mntns, and use WRITEONCE() for writers that can race with lockless readers.

This bug is unreachable unless one of the following is set:

- CONFIGPREEMPTION - CONFIGRCUSTRICTGRACEPERIOD

because it requires an RCU grace period to happen during a syscall without an explicit preemption.

This doesn't seem to have interesting security impact; worst-case, it could leak the result of an integer comparison to userspace (from the level check in capcapable()), cause an endless loop, or crash the kernel by dereferencing an invalid address.