CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose

In the Linux kernel, the following vulnerability has been resolved:

nfsd: guard nfsdserv deref in nfsdfilenetdispose

nfsdfilenetdispose() is the consumer side of l->freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via nfsdfiledisposelistdelayed(). During per-net teardown, nn->nfsdserv is cleared before the filecache laundrette is shut down, so the service thread can still run a dispose pass that finds more than eight entries on l->freeme and dereferences a NULL svcserv:

nfsd service thread loop nfsdfilenetdispose(nn) if (!listempty(&l->freeme)) { ... svcwakeup(nn->nfsdserv); / nn->nfsdserv == NULL / }

The sibling helper nfsdfiledisposelistdelayed() already documents this ordering and caches nn->nfsdserv into a local before testing it for NULL. nfsdfilenetdispose() was introduced with the same raw svcwakeup(nn->nfsdserv) call and never picked up the guard.

Fix by loading nn->nfsdserv into a local svcserv pointer and only calling svcwakeup() when it is non-NULL, matching the pattern in nfsdfiledisposelistdelayed().