Kernel memory disclosure via speculative rlimit dereference

Speculative pointer dereference in Linux Kernel 6.1.8 and earlier allows local users to read kernel memory through a CPU side channel. In do_prlimit(), an attacker-controlled resource index can bypass its bounds check during speculative execution, offset the rlim pointer, and dereference out-of-range kernel data into internal CPU buffers. Exploitation requires low-privileged local syscall access, branch misspeculation, and a concurrent MDS-style sampling channel; the demonstrated consequence is kernel-memory disclosure.