Local privilege escalation via unprotected IPCS iteration

Use-after-free in the Linux kernel allows local users to escalate privileges through SysV shared-memory namespace teardown. shm_destroy_orphaned() calls idr_for_each() without an RCU read-side critical section, so a deferred radix-tree-node free can complete before the iterator reads the next slot. An unprivileged user can trigger the race inside newly created user and IPC namespaces, yielding kernel-memory disclosure, write and arbitrary-free primitives, or a kernel panic.