Local privilege escalation via undersized watch_queue bitmaps

Out-of-bounds writes in the Linux Kernel watch_queue subsystem before 5.17-rc8 allow local users to gain privileges or crash the system. The filter path accepts type values beyond its fixed type bitmap, while watch_queue_set_size derives an allocation bitmap from the requested rather than actual note count, permitting bit operations past both allocations. Any local low-privileged user can trigger the writes; successful exploitation grants kernel-level privileges, while failed attempts can panic the host.