Local privilege escalation via mispatched BPF branch

Memory corruption in the BPF verifier in Linux 6.9 through 6.9.7 allows local users to gain kernel privileges via a crafted BPF program. In kernel/bpf/verifier.c, negative may_goto offsets are patched with the wrong control-flow adjustment, and equal-depth states are pruned despite representing an infinite loop. Unprivileged BPF must be enabled, or the user must hold a delegated BPF token or CAP_BPF; exploitation permits kernel-memory reads or writes, while a self-loop can lock the host.