[PATCH 6.16.y] mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped