Local kernel compromise via unlocked group lookup

Race condition in the Linux kernel panthor scheduler allows local users to compromise the kernel through concurrent group operations. In group_from_handle, xa_load retrieves a group pointer before group_get increments its reference count, so a concurrent xa_erase can remove the object between those operations. Low-privileged local access to the Panthor DRM interface on an Arm Mali system is required; exploitation exposes or alters kernel data or crashes the system.