Local privilege escalation via premature request-pool teardown

Use-after-free in the Linux kernel block subsystem before 5.2 allows local users to execute code in kernel context and gain privileges. The cleanup path postpones freeing scheduler requests until queue release, when their tag set can already be gone; blk_mq_free_rqs then dereferences freed loop-device request memory. Triggering the demonstrated path requires local access to remove a loop device while deferred queue-release work tears down its I/O scheduler; the result is a kernel crash or arbitrary kernel-context code execution.