Local privilege escalation via perf read-size overflow

A heap out-of-bounds write in Linux kernel Performance Events 4.3 through 6.6 allows local users to gain elevated privileges. perf_read_group() allocates its values array from a 16-bit read_size that wraps when a group contains enough events, then increments entries beyond the undersized allocation. A low-privileged user able to call perf_event_open() can corrupt adjacent kernel objects, crash the system, or execute code with kernel privileges.