Local privilege escalation via digest-size race

Out-of-bounds write in the fsverity BPF kfunc in affected Linux kernels allows local users to escalate privileges via a buffer race. The bpf_get_fsverity_digest() kfunc trusts the mutable arg->digest_size field again after bounds checking and uses it as the starting offset for memset(), so a concurrent change writes zeros beyond the dynptr-backed buffer. Reachability requires loading and attaching a BPF LSM program with CAP_BPF and CAP_PERFMON, racing a sibling write, enabling fsverity on an owned file, and invoking a local LSM hook; no victim interaction or network service is involved.