Kernel out-of-bounds access via raced CPUID count

Out-of-bounds access in Linux KVM TDX 6.19 through 7.1.4 allows local users to access kernel memory via a raced CPUID count. tdx_td_init() sizes its copied initialization buffer from one read of user_data->cpuid.nent, while a concurrent userspace write can place a larger count in the copy that setup_tdparams_cpuids() later trusts as the kvm_find_cpuid_entry2() array bound. Exploitation requires local low-privileged access able to invoke KVM_TDX_INIT_VM and win the race; the resulting out-of-bounds parsing can interrupt the host or produce undefined kernel behavior.