Use-after-free in a Linux filesystem rename path

A race between two rename calls drops a reference one time too many. We explain the race and how we made the exploit reliable on stock hardware.