Local privilege escalation via cross-ring notification corruption

Memory corruption in Linux kernel 6.10 before 6.12.58 and 6.13 before 6.17.8 allows local users to escalate privileges. The notification-completion path follows chained ubuf_info entries across different ring contexts and modifies a foreign ring's completion list without holding that context's mutex. An unprivileged local process can create two rings and reuse a TCP socket buffer to trigger the chain, leading to kernel-memory disclosure, arbitrary writes, control-flow hijacking, or a kernel panic or hang.