Cross-task descriptor injection via non-sleepable BPF callback

Improper execution-context validation in Linux 5.14 allows local users to inject a BTF object descriptor into an interrupted task. The bpf_btf_find_by_name_kind helper omits its sleepable marker, so the verifier permits module-BTF lookup from a timer callback and anon_inode_getfd can sleep while expanding the current task's descriptor table. Exploitation requires permission to load an eligible BPF syscall program and invoke the helper from a non-sleepable region; the demonstrated consequence is unintended descriptor installation in the interrupted task.