Local privilege escalation via detached VMA unmapping

Improper VMA cleanup in Linux Kernel 6.19 through 7.0.8 allows local users to corrupt kernel memory through the mmap syscall. The mmap_action_complete error path calls do_munmap() on a not-fully-established, already-detached VMA supplied through a stacked driver mmap hook, duplicating cleanup performed by the mmap handler. Ordinary local users can trigger the path by controlling mmap parameters on an open file descriptor; the corruption enables kernel-memory disclosure or modification, privilege escalation, and kernel panic.