Local privilege escalation via eventpoll teardown race

Use-after-free in Linux Kernel allows local users to gain kernel privileges through concurrent nested epoll teardown. ep_remove() clears file->f_ep without pinning the file, so concurrent __fput() can free and recycle the file and watched eventpoll before hlist_del_rcu() writes through its stale link. Any local UID able to create nested epoll descriptors can race close or deletion operations, producing kernel-memory disclosure, corruption, a panic, or privilege escalation.