In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: Fix use-after-free race condition for maps
It is possible that in between calling fastrpcmapget() until map->fl->lock is taken in fastrpcfreemap(), another thread can call fastrpcmaplookup() and get a reference to a map that is about to be deleted.
Rewrite fastrpcmapget() to only increase the reference count of a map if it's non-zero. Propagate this to callers so they can know if a map is about to be deleted.
Fixes this warning: refcountt: addition on 0; use-after-free. WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcountwarnsaturate ... Call trace: refcountwarnsaturate [fastrpcmapget inlined] [fastrpcmaplookup inlined] fastrpcmapcreate fastrpcinternalinvoke fastrpcdeviceioctl _arm64sysioctl invoke_syscall