Memory corruption via queue-limit allocation race

A race in the NVMe target in Linux 6.1 allows local users to corrupt kernel memory via concurrent queue-limit updates. nvmet_alloc_ctrl() sizes its queue array before registering the controller, allowing nvmet_subsys_attr_qid_max_store() to raise max_qid without deleting that controller; nvmet_install_queue() then indexes beyond the allocation using the larger limit. Triggering requires an enabled NVMe target, privileged configfs write access, and concurrent controller creation; the published consequence is out-of-bounds memory access, not demonstrated code execution.