UBUNTU-CVE-2026-89764: Use After Free

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devresreleaseall() calls Revocable::revoke() via the release callback, while Devres::drop() calls revokenosync() on another CPU. The revoker that does not claim the isavailable swap returns immediately, but the revoker that did may still be executing dropinplace() on the inner data. This can cause a use-after-free when the other revoker's caller proceeds to drop adjacent resources that dropinplace() still references (e.g., Devres<DmaMappedSgt> racing with SGTable freeing the backing sgtable and pages). Fix this by adding a Completion. The release callback signals the Completion after revoke() finishes, and Devres::drop() waits for it when it loses the isavailable swap. This ensures the wrapped object is fully torn down before Devres::drop() returns.