Kernel compromise via misclassified BPF_JSET control flow

eBPF verifier failure in Linux 6.15 through 6.15.9 and 6.16.0 allows local users to read and write kernel memory with BPF_JSET bytecode. The verifier.c can_jump() helper fails to classify BPF_JSET as a conditional jump, so insn_successors() omits the taken branch and computes unsound register liveness and strongly connected components. Reaching the flaw requires local BPF program loading through bpf(BPF_PROG_LOAD), available to unprivileged users only when unprivileged BPF is enabled and otherwise requiring CAP_BPF; accepted bytecode can disclose or overwrite kernel memory, escalate privileges, or crash the host.