Linux kernel IPv4 TCP has a race where tcp_v4_syn_recv_sock() shares ireq->ireq_opt with the child socket; a retransmitted SYN can concurrently build a SYNACK in tcp_check_req() while inet_sock_destruct()/tcp_v4_reqsk_destructor() kfree()s the options, causing UAF in ip_options_build(). Remote unauth peers can leak kernel heap or crash/corrupt memory. Use kfree_rcu() for inet_opt/ireq_opt to mitigate.