Kernel compromise via premature vsock socket release

Use-after-free in Linux kernel vsock and affected Siemens GNU/Linux subsystems allows local users to read or write kernel memory or crash the system. During transport reassignment, transport->release() removes a still-bound socket, and __vsock_bind() later drops its reference count to zero before accessing it. A local low-privileged process must create and rebind a vsock socket across a transport change; successful exploitation compromises the kernel.