Kernel memory disclosure and crash via oversized extent

Use-after-free in Linux EROFS allows attackers to read kernel memory or crash the host via a crafted filesystem image. The EROFS mapping path accepts an uncompressed pcluster whose logical extent exceeds its physical length, so z_erofs_transform_plain copies more page data than the source provides. Triggering the flaw requires the host to mount the image and open, read, or map its contents; the resulting out-of-bounds use-after-free can expose freed kernel data, corrupt memory, or panic the kernel.