Kernel memory disclosure via speculative pointer arithmetic

Out-of-bounds speculative execution in Linux kernel through 5.11.x allows local users to read kernel memory through a side channel. In kernel/bpf/verifier.c, the verifier fails to account for the first pointer modification when restricting later arithmetic, permitting speculative out-of-bounds loads. An unprivileged local user must run a BPF program on an affected system; the resulting side channel discloses kernel-memory contents without modifying them.