From Chrome renderer code exec to kernel with MSG_OOB

This detailed analysis documents CVE-2025-38236: a use-after-free in AF_UNIX MSG_OOB handling in Linux kernels >=6.9, showing how an attacker in a Chrome renderer sandbox can lever the bug to obtain an arbitrary kernel read (via recv(MSG_OOB|MSG_PEEK)) and—through careful heap grooming, reallocation of SLUB pages as pipe and stack pages, and slowing usercopy—produce a write that corrupts page tables to map and modify kernel memory, ultimately enabling privilege escalation; the report also discusses root cause, fixes, usercopy hardening limits, and recommendations to reduce exposed kernel features in sandboxes.