We live in interesting times.
Last month Linux patched a core uaf in the epoll subsystem, we rarely see these kind of bugs.
As i like these kind of bugs, i wrote a few words about it here: https://t.co/XIiPU7LSSN
I tried working on this bug only
without an infoleak and tried to turn it into a one shot universal root primitive but I did not succeed, I never managed to leak data.
You can read the blog and see my attempts at exploiting this, i encourage anyone to try too.
The race itself is pretty tight, but with the right IPI interrupts and some magic it is possible to take control of ep->refs or a mutex_unlock slowpath (providing u an arbitrary kfree primitive), there are other paths available for exploitation.