In the Linux kernel, the following vulnerability has been resolved:

vduse: hold vduse_lock across IDR lookup in open path

vduse_dev_open() looks up struct vduse_dev through the IDR and then
acquires dev->lock only after vduse_lock has been dropped.

This leaves a window where a concurrent VDUSE_DESTROY_DEV can remove the
same object from the IDR and free it before the open path locks the
device, leading to a use-after-free.

Close this race by keeping vduse_lock held until dev->lock has been
acquired in the open path, matching the lock ordering already used by
the destroy path.

https://git.kernel.org/stable/c/35483c5306e09b3190ff937089d404a78012695c

https://git.kernel.org/stable/c/5c1560be8aa6849356455af67518d35c551cbd95

https://git.kernel.org/stable/c/79e12c891940b0c4c75881b7fd82a8cbb8ac97be

https://git.kernel.org/stable/c/93ed4692f2299a40346025979f40e4a9b7b33af7

https://git.kernel.org/stable/c/a2d0a57538fd0b3b3ab75d64bb64f4cd2fab13a2

https://git.kernel.org/stable/c/d94e2947203aead590fd63f667d316d4475d65af

https://git.kernel.org/stable/c/e440e077748939839d9f76e24383b76b785f80ce

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/vdpa/vdpa_user/vduse_dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c8a6153b6c59d95c0e091f053f6f180952ade91e","lessThan":"35483c5306e09b3190ff937089d404a78012695c","versionType":"git","status":"affected"},{"version":"c8a6153b6c59d95c0e091f053f6f180952ade91e","lessThan":"5c1560be8aa6849356455af67518d35c551cbd95","versionType":"git","status":"affected"},{"version":"c8a6153b6c59d95c0e091f053f6f180952ade91e","lessThan":"93ed4692f2299a40346025979f40e4a9b7b33af7","versionType":"git","status":"affected"},{"version":"c8a6153b6c59d95c0e091f053f6f180952ade91e","lessThan":"d94e2947203aead590fd63f667d316d4475d65af","versionType":"git","status":"affected"},{"version":"c8a6153b6c59d95c0e091f053f6f180952ade91e","lessThan":"a2d0a57538fd0b3b3ab75d64bb64f4cd2fab13a2","versionType":"git","status":"affected"},{"version":"c8a6153b6c59d95c0e091f053f6f180952ade91e","lessThan":"79e12c891940b0c4c75881b7fd82a8cbb8ac97be","versionType":"git","status":"affected"},{"version":"c8a6153b6c59d95c0e091f053f6f180952ade91e","lessThan":"e440e077748939839d9f76e24383b76b785f80ce","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/vdpa/vdpa_user/vduse_dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]