Use-after-free in Linux kernel bridge multicast router-port configuration

Repository contains a single C proof-of-concept (poc.c) plus a minimal README claiming CVE-2025-38248 research. poc.c is a local Linux kernel trigger that: - Creates new user, mount, and network namespaces (unshare(CLONE_NEWUSER|CLONE_NEWNS|CLONE_NEWNET)) and maps the caller to uid/gid 0 inside the namespace via /proc/self/{setgroups,uid_map,gid_map}. - Uses raw rtnetlink (AF_NETLINK, NETLINK_ROUTE) to craft RTM_NEWLINK/RTM_DELLINK messages, emulating a subset of `ip link` operations. It creates a bridge (br1) with vlan_filtering and mcast_snooping enabled, creates a dummy interface (dummy1) enslaved to the bridge, toggles bridge_slave multicast router settings, enables bridge multi boolopt mcast_vlan_snooping, then deletes dummy1. - After deletion, it performs a heap spray by allocating 19 key objects using SYS_add_key("user", description, "data", 4, KEY_SPEC_SESSION_KEYRING) with a description padded to a chosen size (1024 bytes), likely to reclaim/fill freed kernel heap slots. - Finally, it creates a second dummy interface (dummy2) and applies bridge_slave settings again, presumably to re-trigger access to a freed/overwritten object. No network callbacks, C2, or remote endpoints are present; the only fingerprintable targets are local procfs paths and kernel interfaces (rtnetlink, keyrings). The code does not include privilege escalation primitives (no cred overwrite, no ROP, no shell), so it is best characterized as a kernel bug trigger + heap grooming PoC rather than a complete exploit.