Local privilege escalation via incorrect in-flight accounting

Use-after-free in the io_uring subsystem of Linux Kernel allows local users to corrupt kernel memory and escalate privileges. Legacy in-flight tracking fails to assign io_uring_fops file types, allowing circular references to outlive context cleanup and poll work to access freed memory. Local code execution with io_uring access is required; successful exploitation can compromise the host kernel or interrupt the system.