Local privilege escalation via notification context confusion

Local privilege escalation in the io_uring notification path in Linux allows local users to read and write arbitrary kernel memory. The io_link_skb function derives prev_notif from the current nd request rather than prev_nd, so its context check compares the current notification with itself and permits cross-ring completion-list corruption. An unprivileged local process can reach the path when io_uring is enabled by issuing consecutive zerocopy sends on a shared socket; exploitation grants root-level control or interrupts service through a kernel hang or panic.