CVE-2024-35874

In the Linux kernel, the following vulnerability has been resolved:

aio: Fix null ptr deref in aio_complete() wakeup

listdelinit_careful() needs to be the last access to the wait queue entry - it effectively unlocks access.

Previously, finishwait() would see the empty list head and skip taking the lock, and then we'd return - but the completion path would still attempt to do the wakeup after the taskstruct pointer had been overwritten.