Local privilege escalation via RxRPC bundle use-after-free

An RxRPC race in affected Linux Kernel releases allows local users to execute code with kernel privileges through connection-bundle handling. In net/rxrpc/conn_client.c, rxrpc_unbundle_conn can destroy a bundle after rxrpc_look_up_bundle retrieves it but before a new connection attaches, leaving a use-after-free window. Exploitation requires low-privileged local code execution and successful timing of the race; the resulting code runs in the kernel context.