Kernel compromise via unprotected neighbor-discovery state

Use-after-free in Linux IPv6 neighbor discovery allows remote attackers to crash or compromise the kernel with network traffic. ndisc_send_skb() reads network-namespace state without holding RTNL or an RCU read lock, permitting the namespace and its socket or hook data to be freed during use. Exploitation requires concurrent network-namespace teardown outside the attacker's control; successful races permit kernel memory access, corruption, or panic.