Local privilege escalation via undersized SVE state buffer

Memory corruption in Linux 6.1.42 and 6.4.7 allows local users to overwrite kernel heap memory through arm64 SME or SVE vector-length changes. The arm64 fpsimd vector-length setter reallocates SVE state before recording the requested new length, so it sizes the buffer with the old value and later writes larger register state beyond the allocation. Any unprivileged local user on hardware with SVE or SME support can trigger the overflow through prctl or same-UID ptrace, leading to kernel memory disclosure, privilege escalation, or a kernel panic.