Local privilege escalation via swap teardown race

A use-after-free race in Linux kernel swap management allows local users to gain kernel privileges during concurrent swapoff. free_swap_and_cache() can continue into swap_page_trans_huge_swapped() after swapoff tears down swap_info_struct, dereferencing freed swap_map memory. An unprivileged process can drive one side through munmap, madvise, exit, or tmpfs operations, but the other side requires administrator-initiated swapoff and a sub-microsecond timing window.