In the Linux kernel, the following vulnerability has been resolved:

mm/mempolicy: fix mpol_new leak in shared_policy_replace

If mpol_new is allocated but not used in restart loop, mpol_new will be
freed via mpol_put before returning to the caller.  But refcnt is not
initialized yet, so mpol_put could not do the right things and might
leak the unused mpol_new.  This would happen if mempolicy was updated on
the shared shmem file while the sp->lock has been dropped during the
memory allocation.

This issue could be triggered easily with the below code snippet if
there are many processes doing the below work at the same time:

  shmid = shmget((key_t)5566, 1024 * PAGE_SIZE, 0666|IPC_CREAT);
  shm = shmat(shmid, 0, 0);
  loop many times {
    mbind(shm, 1024 * PAGE_SIZE, MPOL_LOCAL, mask, maxnode, 0);
    mbind(shm + 128 * PAGE_SIZE, 128 * PAGE_SIZE, MPOL_DEFAULT, mask,
          maxnode, 0);
  }

https://git.kernel.org/stable/c/198932a14aeb19a15cf19e51e151d023bc4cd648

https://git.kernel.org/stable/c/25f506273b6ae806fd46bfcb6fdaa5b9ec81a05b

https://git.kernel.org/stable/c/39a32f3c06f6d68a530bf9612afa19f50f12e93d

https://git.kernel.org/stable/c/4ad099559b00ac01c3726e5c95dc3108ef47d03e

https://git.kernel.org/stable/c/5e16dc5378abd749a836daa9ee4ab2c8d2668999

https://git.kernel.org/stable/c/6e00309ac716fa8225f0cbde2cd9c24f0e74ee21

https://git.kernel.org/stable/c/8510c2346d9e47a72b7f018a36ef0c39483e53d6

https://git.kernel.org/stable/c/f7e183b0a7136b6dc9c7b9b2a85a608a8feba894

https://git.kernel.org/stable/c/fe39ac59dbbf893b73b24e3184161d0bd06d6651