In the Linux kernel 6.0.8, there is a use-after-free in inodecgwbmovetoattached in fs/fs-writeback.c, related to _listdelentryvalid.