Muchun Song

The issue is related to a use-after-free (UAF) vulnerability in the memory cgroup functionality of the Linux kernel. The `mem cgroup from slab obj()` function is supposed to be called under `rcu` lock or `cgroup mutex` to prevent the returned `memcg` from being freed. The fix involves adding a missing `rcu` read lock. This vulnerability was found by code inspection.

A use-after-free vulnerability has been identified in the Linux kernel. The issue arises when the `ipv4 mib exit net` function is called before `tcp sk exit batch` during the destruction of a net namespace, resulting in a use-after-free condition on `net->mib.net statistics` in the `tw timer handler` function. This vulnerability can lead to a real-world panic issue, as demonstrated in Linux 5.4. The bug was introduced by commit 61a7e26028b9, which put net statistics on the `struct net` and freed it when the net namespace was destroyed.