CVE-2026-74522: ksmbd: fix use-after-free in __close_file_table_ids()

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in closefiletableids()

A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode(). ksmbdclosefd() currently marks the file closed and drops the idr-owned reference, but leaves the pointer published in the closing session's idr until the final reference is dropped.

If the foreign holder performs the final ksmbdfdput(), putfdfinal() supplies the foreign session's file table to ksmbdclosefd(). The object is then freed without being removed from its owner's idr, and the owner session later dereferences the stale pointer during file-table teardown.

Remove the volatile id from the owner's idr while ksmbdclosefd() still holds that table's lock, and clear volatileid before dropping the idr-owned reference. A later foreign final put then only performs physical destruction and cannot remove the object from the wrong table.