Linux kernel BPF nullable PTR_TO_BUF NULL dereference

A vulnerability in the Linux kernel BPF verifier allowed direct memory access checks on nullable PTR_TO_BUF pointers without enforcing a prior NULL check. The flaw is in check_mem_access(), which matches PTR_TO_BUF via base_type(); this strips the PTR_MAYBE_NULL qualifier and incorrectly permits direct dereference of pointers that may be NULL. In the map iterator context, ctx->key and ctx->value are typed as PTR_TO_BUF | PTR_MAYBE_NULL, and during stop callbacks these pointers can legitimately be NULL. As a result, direct access to these fields could trigger a kernel NULL pointer dereference. The fix adds a type_may_be_null() guard to the PTR_TO_BUF handling path, aligning it with the existing PTR_TO_BTF_ID validation pattern.