xfs Tempfile UAF

Vulnerability analysis

In the XFS online repair subsystem, the code that creates temporary files for staging reconstructed metadata assigns a pointer to a newly allocated inode early in the process. If a subsequent step in the creation fails, the error handling path correctly unlocks and releases the inode, but it fails to clear the pointer. This leaves a dangling reference that can be accessed later, resulting in a use-after-free condition. The fix adds a single line to nullify the pointer immediately after the inode is released in the error path, preventing any subsequent stale access. This code path is only reachable by a privileged local process holding CAP_SYS_ADMIN that initiates an XFS online repair operation.