Local kernel compromise via BPF timer reuse race

Affected Linux kernel builds with PREEMPT_RT enabled allow local users to disclose or corrupt kernel memory through BPF map updates. During a preallocated hash-map overwrite, htab_map_update_elem frees an old element while its timer can still run, and concurrent reuse lets bpf_obj_free_fields tear down live special fields. Reaching the flaw requires local BPF access and attacker-controlled timer and map-update activity; exploitation can disclose or corrupt kernel memory or panic and lock up the host.