>the kernel handed those saved options from the request socket to the new connection without copying them, then freed them immediately when the connection went away, while another CPU could still be reading them to build a handshake reply.

If this requires a multi-core system to exploit, it's good news for most of the consumer routers that will never get updates. Saved by cheap single-core hardware.

You would be surprised. A lot of cheap consumer routers are have two or four ARM cores. The bigger issue is that they are typically running a kernel from the stone age (< 6.0.0). Sometimes a still-supported LTS kernel like 5.10 or 5.15, but then they stopped at an old patch level.

Heck, apparently even the new Unifi UCG Fiber is running 5.4.213 (September 2022), but maybe they backport some fixes?

[1] https://community.ui.com/releases/dd0283dc-bf71-4140-ae1d-c1...

Those routers probably have 20 other critical un-patched exploits ...

An entire ecosystem of malware crawling and cohabiting in them.