Local privilege escalation via negative BPF offsets

Bounds-check bypass in the BPF verifier in Linux 7.1 allows local users to read or write kernel memory via a crafted BPF program. __check_buffer_access() checks only the instruction offset, while a negative constant in reg->var_off passes verification and wraps the unsigned access-end calculation to zero. Low-privileged BPF access or a delegated BPF token is required, and successful exploitation can disclose or modify kernel memory and elevate privileges.