Local privilege escalation via ipset cleanup race

Use-after-free in Linux netfilter ipset allows local users to gain kernel privileges through list:set teardown races. Namespace or set destruction frees an ip_set while a queued RCU garbage-collection callback still dereferences it, enabling controlled kernel reads, frees, and writes. A low-privileged local account must create ipsets and coordinate namespace teardown with garbage collection; successful exploitation grants root privileges, while failed attempts can corrupt memory or panic the kernel.