Kernel panic via unpatched BPF helper offsets

A BPF flaw in Linux 6.10 allows local users to panic the kernel via helper calls interpreted after JIT compilation is disabled or fails. In bpf_do_misc_fixups(), helper calls selected for JIT inlining retain raw helper IDs instead of rewritten offsets, so interpreter fallback computes invalid call addresses. Triggering requires permission to load and execute a relevant BPF program on an architecture implementing helper inlining, such as ARM64, LoongArch, or RISC-V; the documented consequence is an instruction alignment fault or kernel panic.