Local information disclosure via unlocked socket-tag access

Use-after-free in the Android kernel allows local users with app execution privileges to disclose other applications' data. The get_sock_stat function reads a socket-tag entry after a concurrent path frees it because the function accesses the tag without holding sock_tag_list_lock. A locally installed malicious application can trigger the race without user interaction and read data protected by Android application isolation.