kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c

A flaw was found in the Linux kernel's handling of fork failure when dealing with event messages in the userfaultfd code. Failure to fork correctly can create a fork event that will be removed from an already freed list of events...