Local privilege escalation via stale videobuf2 pointer

Use-after-free in affected Linux 6.10 and later kernels allows local users to read and write freed kernel memory through a V4L2 device node. vb2_ioctl_remove_bufs changes the queue buffer list during legacy file I/O, leaving __vb2_perform_fileio with a stale cached buffer pointer for the next read or write. Access to /dev/videoN is required; the stale pointer enables kernel-memory disclosure or overwrite, privilege escalation, or a kernel crash.