Local kernel compromise via loop-device use-after-free

Use-after-free in the Linux kernel loop driver 2.6.22 through 5.18.2 allows local users with loop-control access to compromise the host. loop_remove destroys and frees lo_device before the final gendisk reference is released, leaving gendisk private_data pointing to freed slab memory during concurrent device opens and removal. Access to /dev/loop-control as a disk-group user or an explicitly permitted container is required; successful exploitation can disclose or modify kernel memory, escalate privileges, or panic the host.