Local privilege escalation via stale BPF packet pointer

Use-after-free in the Linux kernel BPF verifier allows local users to escalate privileges through a crafted extension program. bpf_check_attach_btf_id accepts an extension whose changes_pkt_data behavior differs from the replaced global subprogram, leaving the caller's packet pointer stale after data reallocation. The attack requires CAP_BPF and CAP_NET_ADMIN or delegated BPF-token access; stale-pointer reads expose kernel heap, while writes enable control-flow hijacking or a kernel panic.