[PATCH 6.16 627/627] mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped