Kernel memory disclosure or crash via signed length

Out-of-bounds read in Linux kernels 2.6.18 through 5.10.81 and 5.11 through 5.15.4 allows local users to read kernel stack memory or crash. resp_readcap16() stores an attacker-controlled SCSI READ CAPACITY(16) allocation length in a signed int, then passes the resulting huge length to fill_from_dev_buffer() for a 32-byte stack array. Reachability requires local permission to open an scsi_debug generic SCSI device; the allowed command needs no CAP_SYS_RAWIO and can disclose kernel stack data or trigger a kernel panic.