Kernel code execution via truncated BPF return pointer

Memory corruption in the LoongArch BPF JIT in Linux 6.17 through 6.17.2 allows local users to execute code in the kernel. The struct_ops trampoline truncates an eight-byte pointer return to 32 bits before sign-extending it, causing kernel code to dereference an attacker-steered address. Access to a delegated CAP_BPF token, or ordinary traffic on a host already running an affected BPF qdisc, is required; exploitation can disclose or modify kernel memory, execute kernel code, or crash the system.