System hang via BPF-triggered SELinux audit deadlock

Improper locking in the Linux kernel allows local users to hang affected systems through BPF tracing under SELinux lockdown. The selinux_lockdown hook audits security_locked_down calls from BPF helpers on their execution fast path, where slow_avc_audit can wake kauditd while the scheduler run-queue lock is already held and recursively acquire that lock. A user able to load an affected tracing program can trigger the deadlock or generate enough audit events for an out-of-memory kill; no confidentiality or integrity impact is reported.