Kernel code execution via freed BPF trampoline

Use-after-free in the BPF trampoline path in Linux 7.2 through 7.2.5 allows local users to execute code in the host kernel. On a failed bpf_trampoline_update(), bpf_trampoline_multi_attach_free() frees old_image even though cur_image still points to it and ftrace continues invoking it. Exploitation requires CAP_BPF and CAP_PERFMON, a second fentry program on the same function, and an induced allocation failure; reuse of the freed JIT pages enables arbitrary kernel reads, writes, or a panic.