Privilege escalation via kernel use-after-free

Use-after-free in the Windows Kernel Transaction Manager allows local users with existing privileges to gain elevated kernel access. A race in tm.sys leaves a transaction object reachable after its backing memory is freed, permitting controlled reuse during later kernel operations. Exploitation requires local access, elevated privileges under Microsoft's assessment, and successful race timing; resulting code executes in the kernel security context.