In the Linux kernel af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free (UAF) in sockfs_setattr.
A local attacker can use this flaw to escalate privileges and take control of the system. Other vendors have considered this a 'network' accessible attack, this claim is unsubstantiated at this time.
Note: The attack vector that allowed the use-after-free mentioned in the original report is not introduced in the Red Hat Enterprise Linux 7, 6 and 5 versions of the kernel.
An upstream patch:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1678686]