Local privilege escalation via unchecked verifier error

BPF verifier bypass in Linux Kernel 6.19 through 7.0.9 allows local users to gain kernel privileges via a crafted BPF program. visit_tailcall_insn returns an allocation error for its jump table, but visit_insn fails to propagate it, so verification continues with incorrect tail-call stack liveness and permits out-of-bounds stack access. Exploitation requires local BPF_PROG_LOAD access; unprivileged users reach it only when kernel.unprivileged_bpf_disabled is 0, and successful abuse enables kernel memory disclosure, writes, code execution, or a panic.