Privileged data disclosure via speculative load forwarding

Information disclosure in the Linux kernel allows local users on affected Cortex-A520 cores to read privileged data through a cache side channel. During an EL1-to-EL0 return, the arm64 kernel_exit path performs privileged stack loads and returns without the TLBI and barrier needed to clear speculative value-forwarding state. Exposure requires Cortex-A520 r0p0 or r0p1, a shared ASID and VMID translation regime, and no KPTI; affected cores normally run without KPTI because CSV3 and E0PD suppress that isolation.