Kernel memory corruption via oversized tail copy

Use-after-free in Linux EROFS 5.17 through 5.17.13 and 5.18 through 5.18.2 allows local users to corrupt kernel memory via crafted images. In z_erofs_shifted_transform, the decompressor uses pageofs_out instead of the left-half length for an incomplete uncompressed tail pcluster, causing an oversized memcpy or memmove across page boundaries. An unprivileged local user can trigger the fault by reading an already mounted image with ztailpacking and a shifted tail, exposing adjacent kernel memory, corrupting kernel state, or panicking the host.