In the Linux kernel, the following vulnerability has been resolved:
aio: Fix null ptr deref in aio_complete() wakeup
listdelinit_careful() needs to be the last access to the wait queue entry - it effectively unlocks access.
Previously, finishwait() would see the empty list head and skip taking the lock, and then we'd return - but the completion path would still attempt to do the wakeup after the taskstruct pointer had been overwritten.