Local privilege escalation via swap-cache race

Race condition in the Linux kernel userfaultfd subsystem allows local users to gain kernel-level control through UFFDIO_MOVE. In move_pages_pte(), a lockless swap-cache lookup can return a folio for a recycled swap entry, and the code re-parents it after locking without verifying that it still belongs to that entry. An unprivileged local process can coordinate UFFDIO_MOVE, page faults, and MADV_PAGEOUT in its own address space to corrupt reverse mappings and RSS accounting, expose or overwrite kernel memory, or panic the kernel.