Local kernel crash via framebuffer read

Out-of-bounds memory access in the Linux kernel before 5.18-rc1 allows local users to crash the kernel through a framebuffer read. In smtcfb_read(), open-coded endian fixup logic applies a pointer post-decrement inside fb_readl(), so a three-byte read advances outside the mapped framebuffer. The flaw is reachable when the SM712 framebuffer driver is in use and a local user can read its framebuffer device; exploitation causes a kernel page fault and service interruption.