Local kernel memory disclosure via stale scheduler fence

Use-after-free in the Linux kernel's drm/msm GPU driver allows local users to read freed scheduler memory through a fence timeline query. The ring and VM teardown paths free objects containing a GPU scheduler while an exported, signaled fence still points to that scheduler; a later SYNC_IOC_FILE_INFO query dereferences it. Exploitation requires access to the affected GPU driver and an exported fence, and the documented outcome is a stale kernel-memory read rather than demonstrated code execution.