In the Linux kernel, the following vulnerability has been resolved:
vdpa: fix use-after-free on vpvdparemove
When vpvdpa driver is unbind, vpvdpa is freed in vdpaunregisterdevice and then vpvdpa->mdev.pcidev is dereferenced in vpmodernremove, triggering use-after-free.
Call Trace of unbinding driver free vpvdpa : dosyscall64 vfswrite kernfsfopwriteiter devicereleasedriverinternal pcideviceremove vpvdparemove vdpaunregisterdevice kobjectrelease devicerelease kfree
Call Trace of dereference vpvdpa->mdev.pcidev: vpmodernremove pcireleaseselectedregions pcireleaseregion pciresourcelen pciresource_end (dev)->resource[(bar)].end