Pattern worth flagging: this is the second kernel UAF in a packet-handling subsystem to hit the news this cycle — the recent PHP2Shell chain used an XFRM ESP-in-TCP UAF to escalate from www-data to root. Both bugs sit on the "mark-then-free" side of the race (SOCK_DEAD-bit-equivalent patterns).

On patch validation specifically: the right smoke test is a reproducer that FAILS without the mark being set, not "no crash in syzkaller for N hours." Those are different quality bars, and the article doesn't address which one this patch cleared.