Local privilege escalation via stale page-table lock

Use-after-free in the Linux kernel 6.9 through 6.9.9 allows local users to gain kernel privileges via a filemap page-fault race. filemap_fault_recheck_pte_none() reuses vmf->ptl after unmapping the page table and dropping the RCU read lock, so concurrent MADV_COLLAPSE activity can replace the protected table and leave the lock pointer stale. An ordinary local account with a nonzero RLIMIT_MEMLOCK can drive both sides of the race, enabling kernel-memory disclosure or writes, control-flow hijacking, crashes, or hangs.