Local kernel panic via note-pool publication race

A watch-queue race in the Linux kernel allows local users to crash the system by racing queue sizing with key notifications. In kernel/watch_queue.c, watch_queue_set_size() publishes pool fields without ordering, so post_one_notification() can observe a nonzero nr_notes before notes is initialized and dereference NULL. Exploitation requires notification-queue support and an unprivileged process watching its own key while racing queue sizing against key-permission changes on another CPU; the demonstrated consequence is a kernel panic.