Fair enough. Don't you think it simplifies the issue a little bit? How long would it take to rewrite the entire TCP stack in rust?

Clearly, but it's worth pointing out that this kind of problem isn't uniquely fixed by "just use Rust".

So could have Java, Go, C# or any language with GC. With garbage collection, the options object stays alive as long as any CPU holds a pointer to it, so use-after-free can't happen.

Besides, this exploit is so hard to pull off the only realistic outcome is a kernel panic, and that hasn't even been publicly demoed.