Local privilege escalation via SRCU cleanup race

Use-after-free in SRCU cleanup in affected Linux kernels allows local users to gain kernel privileges by triggering a grace-period race. cleanup_srcu_struct() frees per-CPU SRCU data after checking only for a grace period already in progress, while a required grace period can still begin and access that memory. Reaching the race requires elevated local access such as non-default KVM group membership; successful exploitation grants kernel control, while an unsuccessful attempt can panic the host.