In the Linux kernel, the following vulnerability has been resolved:
iouring: Fix release of pinned pages when _iouaddrmap fails
Looking at the error path of _iouaddr_map, if we fail after pinning the pages for any reasons, ret will be set to -EINVAL and the error handler won't properly release the pinned pages.
I didn't manage to trigger it without forcing a failure, but it can happen in real life when memory is heavily fragmented.