Kernel disclosure and corruption via unreferenced splice buffer

Use-after-free in the Linux kernel's SMC loopback receive path allows local users to disclose or corrupt kernel memory through splice(). The smc_lo_register_dmb() function allocates a DMB with kzalloc(), but smc_rx_splice() passes that non-page-backed memory to get_page(), leaving the pipe without a valid reference after the socket frees the buffer. An unprivileged process can drive both loopback AF_SMC endpoints without user interaction, enabling kernel-heap disclosure, memory corruption, privilege escalation, or a kernel panic.