In the Linux kernel, the following vulnerability has been resolved:

alloc_tag: fix use-after-free in /proc/allocinfo after module unload

allocinfo_start() only reinitializes the codetag iterator at position 0. 
For subsequent reads (position > 0), it reuses cached iterator state from
the previous batch.  allocinfo_stop() drops mod_lock between read batches,
which allows module unload to complete and free the module memory that the
cached iterator still references:

  CPU0 (read)                        CPU1 (rmmod)
  ----                               ----
  allocinfo_start(pos=0)
    down_read(mod_lock)
    allocinfo_show()
    ...
  allocinfo_stop()
    up_read(mod_lock)
                                     codetag_unload_module()
                                       kfree(cmod)
                                       release_module_tags()
                                     ...
                                     free_mod_mem()
  allocinfo_start(pos=N)
    down_read(mod_lock)
    // reuses cached iter, skips re-init
  allocinfo_show()
    ct->filename   <-- UAF

After free_mod_mem() frees the module's .rodata, allocinfo_show()
dereferences ct->filename, ct->function which point there.

Save the iterator state in allocinfo_next() and resume from it in
allocinfo_start() with codetag_next_ct(), which detects module removal via
idr_find() returning NULL and skips to the next module.

https://git.kernel.org/stable/c/008ceffd44040f809aead6d7bef7cb1210c4149a

https://git.kernel.org/stable/c/2956268efc457cb05d29c1bf94de1e8e684d7bbc

https://git.kernel.org/stable/c/37e3e8a2c3bfdd503209f043f8bbfbdcf5a1d92f

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["lib/alloc_tag.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9f44df50fee4d2f6cb374177244ccfa9f0a5cc95","lessThan":"37e3e8a2c3bfdd503209f043f8bbfbdcf5a1d92f","versionType":"git","status":"affected"},{"version":"9f44df50fee4d2f6cb374177244ccfa9f0a5cc95","lessThan":"008ceffd44040f809aead6d7bef7cb1210c4149a","versionType":"git","status":"affected"},{"version":"9f44df50fee4d2f6cb374177244ccfa9f0a5cc95","lessThan":"2956268efc457cb05d29c1bf94de1e8e684d7bbc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["lib/alloc_tag.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]