dm TableDevices UAF

Vulnerability analysis

When two concurrent device-mapper table load ioctls race—one succeeding and the other failing—the successful path walks the mapped device's table device list without holding the protecting lock, while the failing path tears down its table and frees those same list entries. This results in a use-after-free where the successful path accesses memory that the failing path has already released. The fix extends the existing mutex over the entire list walk and holder-registration loop, and restructures the error-handling paths so the lock is held during cleanup, preventing the teardown from freeing entries while another thread is still iterating over them. The vulnerability is reachable locally by any process holding CAP_SYS_ADMIN in the init namespace that issues concurrent DM table load ioctls.