XBOW discovered CVE-2026-72018, an out-of-bounds write in the Linux kernel's SMC-D driver, and turned one weak primitive into a working root exploit.