CVE-2026-93073: dax: read holder_ops once in dax_holder_notify_failure()

In the Linux kernel, the following vulnerability has been resolved:

dax: read holderops once in daxholdernotifyfailure()

daxholdernotifyfailure() reads daxdev->holderops twice without READONCE() -- once for the NULL check and once for the indirect notifyfailure() call. A concurrent fsputdax() can clear holderops between the two reads, so the check can observe a non-NULL pointer while the call dereferences NULL. (killdax() also clears holderops, but only after synchronizesrcu(), so it cannot race a reader that is inside daxreadlock(); fsputdax() does no such synchronization.)

Fetch holderops once into a local with READONCE() so the NULL check and the indirect call observe the same value.