Linux Kernel rxrpc Call Timer Handling Vulnerability Leading to Use-After-Free

A vulnerability in the Linux kernel's handling of the rxrpc_call structure can lead to a use-after-free condition. The issue arises because a timer associated with the call can be restarted by packet input routines running in softirq mode, while the call is being destroyed. This can cause the timer, which may have already been stopped, to be reactivated. If the timer is deallocated before its dispatch code is executed, it can result in a kernel oops error.

Impact

Exploitation of this vulnerability can cause a kernel oops, indicating a use-after-free error that could potentially be exploited to execute arbitrary code or cause a denial-of-service condition by crashing the system.