> If the new socket is freed first, the options are freed with a plain kfree() while still in use: a use-after-free. A similar race exists when request sockets are migrated between listeners, which only happens with net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE eBPF program.
I think we need to now discuss whether if Linux (and C) are still fit for purpose in the AI age given how common the C style vulnerabilities are quickly being discovered, everywhere in the kernel.