Kernel memory corruption via timerlat teardown race

Use-after-free in affected Linux kernel 6.5 through 6.11-rc6 builds allows local users to corrupt kernel memory through timerlat. When SIGTERM closes one instance's timerlat descriptors while another instance resets its threads, trace_osnoise.c cancels and frees the same kthread hrtimer twice because teardown is not synchronized with the tlat_var->kthread reset. Local low-privileged access to tracefs timerlat controls is required; successful exploitation can compromise kernel confidentiality, integrity, and availability.