Kernel-address disclosure via atomic-fetch pointer mishandling

Information disclosure in the Linux kernel before 5.16-rc6 allows local users to expose kernel pointer addresses through crafted eBPF code. The eBPF verifier fails to preserve pointer-type information for some atomic fetch operations and can return an internal kernel address to userspace. Exploitation requires local access and permission to load eBPF code; the disclosure reveals kernel pointer addresses that weaken exploit mitigations.