The main reason for this system panic error is that socket is being closed while packet sent via that socket is queued to userspace. After userspace reinjects (userspace or another netfilter rule asks for the packet to get queued again,) the refcount transition will be 1 -> 0 -> 1 (-> 0), thus double-free occurs.
This error is being managed in bugzilla 1885682 and 1886557.