Local privilege escalation via regbuf size truncation

Integer truncation in the io_uring registered-buffer path in Linux 6.15 through 6.17.7 allows local users to corrupt kernel memory. io_estimate_bvec_size() stores a segment estimate in an int, allowing attacker-controlled iovec lengths to wrap the allocation size before bio_vec entries are written past the undersized buffer. Unprivileged local access and enabled io_uring are sufficient, and the heap write supports kernel-memory disclosure, control-flow hijacking, or a kernel panic.