Local root escalation via mismatched nftables element lengths

Type confusion in Linux kernel Netfilter through 5.18.9 allows local users to gain root privileges via crafted nftables set elements. nft_setelem_parse_data skips the data-length equality check for NFT_DATA_VERDICT, so nft_set_elem_init allocates for a short element and copies the larger set length into the heap object. Exploitation requires an unprivileged user namespace with CAP_NET_ADMIN in its network namespace; the demonstrated exploit opens a root shell and subsequently triggers a kernel panic.