Freed-memory writes via inherited PSP socket associations

Use-after-free in Linux PSP socket cloning allows attackers to write freed kernel memory through inherited receive associations. sock_copy() copies sk->psp_assoc into accepted sockets without acquiring a reference, so closing the listener frees an association still referenced by TIME_WAIT timers. Triggering requires a PSP receive association on a listener and accepted connections entering TIME_WAIT; the reported result is a kernel memory-safety violation, not demonstrated code execution.