Kernel privilege escalation via VM_BIND handle confusion

Memory corruption in Linux 6.17 through 6.17.2 allows local users to gain kernel privileges through a crafted msm VM_BIND ioctl. In vm_bind_job_lookup_ops, a failed handle lookup leaves a union member as an attacker-controlled handle that cleanup treats as a drm_gem_object pointer. Any unprivileged process able to open an msm DRM render node can trigger a kernel oops or use controlled memory to disclose or modify kernel memory.