Exploit for CVE-2025-40019

## https://sploitus.com/exploit?id=45329CD7-96B1-5F4C-B95C-9C6B5C73402D
# CVE-2025-40019-Essiv
A PoC for CVE-2025-40019 in ESSIV module. (exploit WIP)

for exploitation, note that scatterlist (both `req->src` and `req->dst`) has `page_link` member. `page_link` is a way to encode sg table info alongside page pointer as far as I understand:
``` bash

(gdb) ptype struct scatterlist
type = struct scatterlist {
    unsigned long page_link;
    unsigned int offset;
    unsigned int length;
    dma_addr_t dma_address;
    unsigned int dma_length;
    unsigned int dma_flags;
}

scatterwalk_start_at_pos (pos=8, sg=0xffff8880084c5020, walk=) at ./include/crypto/scatterwalk.h:97
97              while (pos > sg->length) {

(gdb) set $pl = (unsigned long)sg->page_link

(gdb) set $page = (struct page *)($pl & ~0x3)

(gdb) p $page

$66 = (struct page *) 0xffffea0000722700
(gdb) p *$page

$67 = {
  flags = 72057594038061324,
  {
    {
      {
        lru = {
          next = 0x0 ,
          prev = 0xdead000000000122
        },
        {
          __filler = 0x0 ,
          mlock_count = 290
        },
        buddy_list = {
          next = 0x0 ,
          prev = 0xdead000000000122
        },
        pcp_list = {
          next = 0x0 ,
          prev = 0xdead000000000122
        },
        {
          pcp_llist = {
            next = 0x0 
          },
          order = 290
        }
      },
      mapping = 0xffff88800ba92cc1,
      {
        __folio_index = 34359738366,
        share = 34359738366
      },
      private = 0
    },
    {
      pp_magic = 0,
      pp = 0xdead000000000122,
      _pp_mapping_pad = 18446612682265668801,
      dma_addr = 34359738366,
      pp_ref_count = {
        counter = 0
      }
    },
    {
      compound_head = 0
    },
    {
      _unused_pgmap_compound_head = 0x0 ,
      zone_device_data = 0xdead000000000122
    },
    callback_head = {
      next = 0x0 ,
      func = 0xdead000000000122
    }
  },
  {
    page_type = 0,
    _mapcount = {
      counter = 0
    }
  },
--Type  for more, q to quit, c to continue without paging--

  _refcount = {
    counter = 1026
  }
}

```