Local privilege escalation via cgroup parameter type confusion

Use-after-free in Linux Kernel before 5.14 rc2 allows local users to escalate privileges and break containers via crafted fsconfig parameters. The cgroup1_parse_param parser treats a union value as a string without checking its type, so a file descriptor supplied as the source parameter is mis-stored and later freed incorrectly. Exploitation requires local user access and can yield host privilege escalation, container breakout, or a denial of service.