A use-after-free vulnerability was found in the Linux kernel's strparser subsystem (net/strparser/strparser.c), reachable via ESP-in-TCP (espintcp).

When espintcp_close() calls strp_done() to tear down the stream parser, it cancels msg_timer_work via cancel_delayed_work_sync(). However, strp_data_ready() can concurrently run on another CPU and pass the strp->stopped check before strp_stop() sets it. This allows strp_recv() to re-arm msg_timer_work via mod_delayed_work() after cancellation has completed. When the socket context is subsequently freed, the re-armed
timer fires against freed memory, resulting in a use-after-free. The vulnerable code path is reachable by an unprivileged local user was introduced in commit bbb03029a899 ("strparser: Generalize strparser"). 

Upstream patch (not yet merged):
https://lore.kernel.org/all/aZgpkyTDU3aXe_V0@v4bel/