wkpwn/cve-2026-83834Analysis of a use-after-free race in FSRendezvousServer::PublishRx and ConsumeTx, where Close() can free an FSStreamReg object between mutex release and lock acquisition.
FSRendezvousServer::PublishRx and FSRendezvousServer::ConsumeTx dereference a FSStreamReg object with an identical, broken pattern: take the server mutex, confirm the object is still list-resident, drop the mutex, then take the object's own lock — with nothing in between to keep it alive.
Because no reference is taken, there is a narrow window between the server mutex being released and the object's own lock being taken during which FSRendezvousServer::Close() can free the object, leading to a use-after-free.
Credit: @zoverin
