Kernel panic via unreferenced PMU module unload

Use-after-free in the Linux kernel vpa_pmu PMU in 6.13 allows local users to crash a pSeries LPAR after an administrator unloads the module. vpa_pmu_event_init leaves the PMU owner unset, so an active perf event holds no module reference and later dereferences PMU state after unload. The flaw requires a PowerPC pSeries LPAR with Book3s-HV nested APIv2 counters, an accessible perf event, and a privileged module unload; the demonstrated consequence is a kernel panic.