The use-after-free occurs within ip_options_build (net/ipv4/ip_options.c) which CPU #2 processing the retransmitted SYN packet uses to read/copy options out of the unallocated/reallocated memory that CPU #1 had already freed up. Remember that the options header is variable length too so CPU #2 is seemingly under-reading/over-reading this variable length options header by some fairly random amount between 1-256 bytes depending on what data has been written to the reallocated memory.[1]

The undocumented part (per LKML discussions at least) is what happens next in the attack. Seemingly CPU #2 or CPU #3[2] comes along later to process the random jibberish options header and rarely (in Anthropic's case it took 48min locally) that random jibberish will be returned to the attacker (e.g. copy jibberish options header to a response packet?) and it'll expose a return pointer to a fixed kernel function. The attacker then crafts a SYN packet and retransmits it with an options header that places a return pointer in the right place, and hopes for another race to occur where CPU #3[2] executes a callback to an attacker-controlled pointer stored within the options header data. Anthrophic's case said it took 5min for this stage of the attack to work locally.

Someone will probably write this all up at some point and it'll be quite a long and detailed read of how the 48min and 5min stages of the attack work and perhaps this is where MPTCP code paths are involved due to the way they process the TCP options header data.

[1] https://en.wikipedia.org/wiki/Internet_Protocol_Options

[1] Author of the kernel patch suggests that CPU #3 (three way race) is needed per https://lore.kernel.org/netdev/CAL4WiiroQ8XyDzUnmuy5FmJ4SWfZ...