Local privilege escalation via BPF trie overflow

An out-of-bounds write in Linux kernel BPF LPM trie iteration allows local users to corrupt kernel memory through a crafted trie. trie_get_next_key allocates a stack for max_prefixlen nodes but records max_prefixlen plus one nodes when traversing a complete root-to-leaf path. A local user with a readable LPM_TRIE map descriptor can cause a kernel crash or gain elevated privileges without user interaction.