Kernel state corruption via writable borrowed cpumasks

Improper type validation in Linux 6.15 allows local users to modify kernel cpumask data through a crafted BPF program. The bpf_cpumask_populate() verifier prototype treats its bitmap_copy() destination as struct cpumask *, so it accepts borrowed pointers returned by read-only kfuncs as writable storage. Exploitation requires local low-privileged access and permission to load the relevant BPF program; writes can corrupt kernel state and interrupt service.