CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

In the Linux kernel, the following vulnerability has been resolved:

bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

commit 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs") moved inode cleanup from ->freeinode() into ->destroyinode() to avoid sleeping in RCU context when calling bpfanyput(). However this removed the RCU delay on freeing the inode itself and the cached symlink body (ilink), both of which can be accessed by RCU pathwalk (picklink, maylookup etc.).

This causes a use-after-free when a concurrent unlinkat() drops the last inode reference and destroyinode() frees the inode immediately, while another task is still walking the path in RCU mode and reads inode->iopflags (offset +2) inside currenttime() -> ismgtime().

KASAN reports: BUG: KASAN: slab-use-after-free in ismgtime include/linux/fs.h:2313 Read of size 2 at addr ffff8880407e4282 (offset +2 = iopflags)

The rules (per Al Viro): ->destroyinode() called immediately, can sleep, use for blocking cleanup e.g. bpfanyput() ->freeinode() called after RCU grace period, use for freeing inode and anything RCU-accessible e.g. ilink

Fix: split the two concerns properly: - keep bpfanyput() in bpfdestroyinode() since it is blocking and needs to run promptly - introduce bpffreeinode() to handle kfree(ilink) and freeinodenonrcu() with proper RCU delay, preventing the UAF