Container escape via prematurely freed BPF maps

Use-after-free in BPF map-in-map handling in Linux allows local users with BPF access to escape containers and execute host code. bpf_map_fd_put_ptr() drops the last inner-map reference immediately, while a BPF program can still access that map because map_free callbacks do not wait for the required RCU grace periods. The published proof of concept wins this race to corrupt an array map and overwrite core_pattern; exploitation requires high privileges, and a failed attempt can crash or destabilize the kernel.