The thing that is freed and then used-after-free in case the exploit is due to the data structure temporarily storing IP options from the original packet.
trigger warning: text fully written by hungry ghosts, I only had them apply 100+ item checklists to make it hopefully more readable.
i suspect RH might have indeed covering the loopback case… or, just hedging in general - glass houses and all that…
Hope this helps.
https://ayourtch-llm.github.io/apchat-blog/posts/2026-11-02-...
P.s. I now realize having stared at the code a bit has put me into the “so what ?” mode, which evidently wasn’t compatible with the prevailing sentiment among folks that used only the advisories :-) sorry to all who I got upset.
And sorry for the slang :-) “hungry ghosts in a jar” is much more fun than “LLM agents”