Kernel memory corruption via BPF stack-size overflow

Integer overflow in the Linux BPF verifier allows local users to corrupt kernel memory by loading a crafted BPF program. check_stack_range_initialized() accepts a signed access size that can wrap negative, then walks outside the verifier's stack-state array. The path requires local access and CAP_BPF or delegated BPF-token capability; successful abuse enables kernel reads and writes, while failure can panic the system.