Kernel compromise via BPF timer use-after-free

Use-after-free in Linux 5.15 through 6.9.9 and 6.10 release candidates allows local users to corrupt kernel memory via BPF timers. In kernel/bpf/helpers.c, bpf_timer_cancel_and_free synchronously cancels an hrtimer while concurrent callbacks can cancel each other, deadlocking, or leaves an armed timer queued after its state is freed by RCU. Exploitation requires low-privileged local access and a race involving map elements that contain BPF timers; the use-after-free can corrupt kernel memory, while mutual cancellation can hang the system.