fs/buffer: fix use-after-free when call bh_read() helper (CVE-2025-39691) | HOL Guard CVE