Local kernel compromise via stale fence insertion

Use-after-free in Linux kernel 5.0 through 5.19.7 allows local users to compromise the kernel by importing an older dma-buf fence. dma_resv_add_fence inserts an imported fence without verifying that its timestamp is later than every existing fence, permitting premature release of referenced buffer storage. Any unprivileged local user able to obtain a dma-buf file descriptor can trigger the flaw without another user's interaction, enabling kernel memory reads, writes, crashes, or hangs.