Local privilege escalation via stale futex pointer

Use-after-free in io_uring futex handling in the Linux kernel allows local users to execute code with kernel privileges. On a failed IORING_OP_FUTEX_WAIT request, io_futex_wait() frees io_futex_data without clearing req->async_data or its validity flag, so a recycled io_kiocb later dereferences attacker-reclaimed memory as an io_poll object. Low-privileged local code can trigger the deterministic error path when unprivileged io_uring is enabled, leading to kernel privilege escalation or a kernel panic.