Local privilege escalation via stale binder device entry

Use-after-free in Linux kernel 6.14 binderfs allows local users to corrupt kernel memory and crash the system through device teardown. binder_free_proc() frees a binder device without first removing it from binder_devices, leaving binder_remove_device() to write through a stale list entry during inode eviction. A low-privilege user must mount binderfs and control device creation, open or close operations, process teardown, and unmount ordering; successful exploitation can disclose or alter kernel memory or stop the system.