In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: fix use-after-free race in fastrpc_map_create

fastrpc_map_lookup returns a raw pointer after releasing fl->lock. The
caller fastrpc_map_create then calls fastrpc_map_get (kref_get_unless_zero)
on this unprotected pointer. A concurrent MEM_UNMAP can free the map
between the lock release and the kref operation, resulting in a
use-after-free on the freed slab object.

Restore the take_ref parameter to fastrpc_map_lookup so the reference
is acquired atomically under fl->lock before the pointer is exposed to
the caller.

https://git.kernel.org/stable/c/07ebe87915d8accdaba20c4f88c5ae430fe62fbb

https://git.kernel.org/stable/c/0a3b87293fbd34fda651e6aead9964f84b893962

https://git.kernel.org/stable/c/5b0166112019d1dce30b976ab28fd67f7f0be532

https://git.kernel.org/stable/c/8b080c89183196fd3e49212f2a1a1c4a29335b9c

https://git.kernel.org/stable/c/992f121796b7ca83a5a8b93da24e971363206218

https://git.kernel.org/stable/c/f20f6512ecb75c816e0debf4551a138f098615c4

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/misc/fastrpc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0b70ec82b309a4093106ff399da1911ad23b52d3","lessThan":"0a3b87293fbd34fda651e6aead9964f84b893962","versionType":"git","status":"affected"},{"version":"d7513b47082c08105e837b06cebeb3f07a5fa56f","lessThan":"8b080c89183196fd3e49212f2a1a1c4a29335b9c","versionType":"git","status":"affected"},{"version":"802359a52676176b18713e33caa17572ad009057","lessThan":"5b0166112019d1dce30b976ab28fd67f7f0be532","versionType":"git","status":"affected"},{"version":"10df039834f84a297c72ec962c0f9b7c8c5ca31a","lessThan":"992f121796b7ca83a5a8b93da24e971363206218","versionType":"git","status":"affected"},{"version":"10df039834f84a297c72ec962c0f9b7c8c5ca31a","lessThan":"f20f6512ecb75c816e0debf4551a138f098615c4","versionType":"git","status":"affected"},{"version":"10df039834f84a297c72ec962c0f9b7c8c5ca31a","lessThan":"07ebe87915d8accdaba20c4f88c5ae430fe62fbb","versionType":"git","status":"affected"},{"version":"f3f59bab68e9bc714f757ab22f3fb36153014043","versionType":"git","status":"affected"},{"version":"6.1.156","lessThan":"6.1.176","versionType":"semver","status":"affected"},{"version":"6.6.112","lessThan":"6.6.143","versionType":"semver","status":"affected"},{"version":"6.12.53","lessThan":"6.12.94","versionType":"semver","status":"affected"},{"version":"6.17.3","lessThan":"6.18","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/misc/fastrpc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.94","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.36","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.13","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]