Local privilege escalation via dangling socket pointer

Use-after-free in Linux 6.11 through 6.11.7 allows local users to disclose kernel memory, corrupt kernel state, or panic the system. On an AF_SMC creation failure, __smc_create frees struct smc_sock but leaves sock->sk pointing to that freed object for a later dereference. An unprivileged process can invoke the local socket path without user interaction; successful reuse can grant kernel-level control, while a failed attempt can crash the host.