Linux Kernel SOCK_DIAG Privilege Escalation Exploit

The __sock_diag_rcv_msg() function in net/core/sock_diag.c of the Linux kernel does not validate the value of the sdiag_family field, which is used to index the sock_diag_handlers array. This can be exploited by a local unprivileged attacker to gain root privileges by sending a specially crafted Netlink message to the kernel.