Linux TCP fixes race UAFs when sockets flip listen and disconnect
connect(AF_UNSPEC), listen(), and IPV6_ADDRFORM left request sockets and parent state that concurrent paths could free while still in use.
By kexec#tcp
Linux makes per-VMA locks unconditional on all configs
The change lets binder and TCP drop mmap_lock fallbacks, and Andrew Morton has queued the series for testing.
By oops