Local privilege escalation via VT-d device teardown race

Use-after-free in the Linux kernel's Intel VT-d I/O page-fault path allows local users to gain kernel-level privileges. The prq_event_thread path can retain a PCI device after device_del() frees its IOMMU state, then dereference that stale state while reporting a page fault. Exploitation requires access to a page-request-capable device, such as an SVA accelerator, DRM render node, or PRI device assigned through VFIO/IOMMUFD.