In the Linux kernel through 4.19, a use-after-free can occur due to a race
condition between fanout_add from setsockopt and bind on an AF_PACKET
socket. This issue exists because of the
15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race
condition. The code mishandles a certain multithreaded case involving a
packet_do_bind unregister action followed by a packet_notifier register
action. Later, packet_release operates on only one of the two applicable
linked lists. The attacker can achieve Program Counter control.

tyhicks

The xenial 4.4 kernel inherited the fix via a rebase on linux-stable