Critical Linux Kernel Vulnerabilities Patched: SMB, Bluetooth, and xfrm

A flaw exists in the ksmbd component where the `conn->binding` flag is not properly cleared after a failed binding request. This can lead to subsequent SMB operations falling back to the global sessions table, potentially allowing unauthorized access or denial-of-service. An attacker could exploit this by crafting a malicious SMB2_SESSION_SETUP request.

A use-after-free vulnerability exists in the Bluetooth SCO (Synchronous Connection-Oriented) subsystem within the `sco_recv_frame()` function. Due to a missing `sco_sock_hold()` call, the socket reference can be released concurrently while the function is still accessing it, leading to a crash or potential code execution. An attacker could trigger this by manipulating Bluetooth connections.

A race condition exists in the xfrm networking framework within the `xfrm_nat_keepalive_net_fini()` function. After canceling a delayed work item, the function attempts to re-schedule it, potentially on a freed network namespace, leading to a crash or other unexpected behavior. This can be triggered during network cleanup operations.