Kernel compromise via futex requeue race

Use-after-free in Linux kernel futex requeue-PI handling allows local users to compromise kernel memory through a timing race. The futex_wait_requeue_pi path releases its stack-resident futex_q while requeue_pi_wake_futex still uses q->task because the state changes before the task pointer is read. Reaching the race requires low-privileged local execution, a concurrent requeue-PI operation, and a timeout or signal wakeup; memory corruption can expose, alter, or interrupt the kernel.