Kernel crash via poisoned swapcache folio reclaim

Denial of service in Linux kernel mm/vmscan allows local users to crash the kernel by reclaiming a poisoned dirty swapcache folio. shrink_folio_list() returns the poisoned folio to the LRU after memory-failure handling clears its uptodate flag, so later reclaim passes it to add_to_swap() and triggers VM_BUG_ON_FOLIO. Exploitation requires local access, a dirty unlocked swapcache page, injected memory failure, process exit, and another reclaim cycle; the bounded consequence is a kernel crash.