Local privilege escalation via unlocked multicast source list

Use-after-free in Android kernel inet sockets allows local users to gain elevated privileges by racing socket open and close operations. The ip_check_mc_rcu function accesses an ip_sf_list entry without holding pmc->lock after ip_mc_del_src can free that entry under the lock. A local application needs no additional execution privileges or user interaction, and successful exploitation elevates its privileges on the device.