The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in
net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI
definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an
arbitrary value.

It was discovered that the CIPSO implementation in the Linux kernel did not
properly perform reference counting in some situations, leading to use-
after-free vulnerabilities. An attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code.

sbeattie

looks to be introduced primarily in d7cce01504a0 1165affd484889d4986cf3b724318935a0b120d8 seems like an unrelated separate issue?