Local privilege escalation via stale guest_memfd binding

Use-after-free in Linux KVM 6.8 allows local users with /dev/kvm access to corrupt kernel memory during guest_memfd teardown. When a dying guest_memfd retains a deleted memslot binding, kvm_gmem_release writes through the freed kvm_memory_slot and passes its stale data into MMU teardown. A local process controlling both sides of the race can disclose or modify kernel memory, escalate privileges, or panic the host without guest access or user interaction.