Local privilege escalation via dirty COW bypass

Race condition in mm/gup in Linux 5.16 through 5.19.5 allows local users to escalate privileges by modifying read-only shmem pages. FOLL_FORCE treats a dirty page-table entry installed by UFFDIO_CONTINUE as proof that copy-on-write completed, so /proc/self/mem writes reach protected tmpfs or shmem content. Exploitation requires low-privileged local code, a controllable race, and an x86_64 or arm64 kernel with minor-fault userfaultfd support; it bypasses file permissions and memfd write seals.