Use-after-free via unlocked rbtree callback

Use-after-free in the Linux kernel BPF verifier allows local users who can load crafted BPF programs to resume a tree walk on freed pointers. __bpf_rbtree_add() retains parent and link pointers across a program-supplied comparison callback, while resilient lock kfuncs previously let that callback release the root lock so another CPU could remove and free the referenced node. Reaching the flaw requires BPF program-loading access and a resilient-lock-protected rbtree; published material does not establish whether stale-pointer use causes a crash, disclosure, or code execution.