Local privilege escalation via ebtables teardown race

A teardown race in Linux Kernel allows local users to gain kernel privileges through ebtables administration syscalls. Concurrent setsockopt or getsockopt handling can retain an ebt_table while __ebt_unregister_table frees its backing structures, causing a kernel use-after-free. The path requires CAP_NET_ADMIN in the target network namespace, which unprivileged local users can obtain through user and network namespaces; successful exploitation permits kernel memory disclosure, modification or code execution, while failed attempts can panic the host.