Local privilege escalation via incorrect BPF pruning

Improper BPF verifier pruning in Linux Kernel allows local users to gain kernel memory read and write access through crafted BPF bytecode. In backtrack_insn, atomic fetch instructions are treated as ordinary stores, so precision is not propagated from the fetched destination register to its stack slot and distinct verifier states are incorrectly pruned. Loading the crafted program requires CAP_BPF, CAP_SYS_ADMIN, or an equivalent BPF token; a successful bypass permits kernel-memory corruption or a host crash.