In the Linux kernel, the following vulnerability has been resolved:

ocfs2: rebase copied fsdlm LVB pointers in locking_state

The locking_state debugfs iterator snapshots struct ocfs2_lock_res by
value under ocfs2_dlm_tracking_lock and later formats that copy in
ocfs2_dlm_seq_show().  That is fine for the inline fields, but the
userspace fsdlm stack stores the LVB through lksb_fsdlm.sb_lvbptr.  Once
the iterator drops the tracking lock, a copied non-NULL sb_lvbptr still
points into the original lockres owner, so teardown can free that
container before the debugfs dump walks the raw LVB bytes.

Rebase the copied sb_lvbptr to the copied l_lksb before dumping the raw
LVB.  The seq snapshot already carries the inline LVB storage reserved in
struct ocfs2_dlm_lksb, so the debugfs reader can dump the copied bytes
without borrowing the original lockres lifetime.

The buggy scenario involves two paths, with each column showing the order
within that path:

locking_state reader:                  lockres teardown:
1. ocfs2_dlm_seq_start()/next()        1. file release or another owner
   copies struct ocfs2_lock_res           teardown reaches
2. ocfs2_dlm_seq_show() formats           ocfs2_lock_res_free()
   the copied row                      2. the lockres is removed from the
3. ocfs2_dlm_lvb() follows the            tracking list
   copied sb_lvbptr                   3. the owner frees the original
                                          lockres container

Validation reproduced this kernel report:
KASAN slab-use-after-free in ocfs2_dlm_seq_show+0x1bd/0x430
RIP: 0033:0x7f8ec4b1e29d
The buggy address belongs to the object at ffff88810a1e0800 which belongs
to the cache kmalloc-1k of size 1024
The buggy address is located 368 bytes inside of freed 1024-byte region
[ffff88810a1e0800, ffff88810a1e0c00)
Read of size 1
Call trace:
  dump_stack_lvl+0x66/0xa0
  print_report+0xce/0x630
  ocfs2_dlm_seq_show+0x1bd/0x430 (fs/ocfs2/dlmglue.c:3137)
  srso_alias_return_thunk+0x5/0xfbef5
  __virt_addr_valid+0x19f/0x330
  kasan_report+0x

https://git.kernel.org/stable/c/07aa4a8ebacde3d0ba50f60d2964f274ee7629bc

https://git.kernel.org/stable/c/185427b5f7a209254c85c18aad5a4a8e009b2f30

https://git.kernel.org/stable/c/610a0d2a35496738e1472fb0f318d5008a1c634f

https://git.kernel.org/stable/c/6b38a5b8ee951e5b244e9a3c3d28d0f5e7c51411

https://git.kernel.org/stable/c/8614a8f7e81edd34c9f67e454e7024fd12a2a341

https://git.kernel.org/stable/c/93612d48fa42b3d1a637eb9279e15281c611c000

https://git.kernel.org/stable/c/bb44a7690a4d553da705919cf666a80f5ca9011c

https://git.kernel.org/stable/c/e037c1250cc90e7aacb002357d1b0399fc65ecfc

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ocfs2/dlmglue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cf4d8d75d8aba537a19b313a9364fd08ddbd5622","lessThan":"185427b5f7a209254c85c18aad5a4a8e009b2f30","versionType":"git","status":"affected"},{"version":"cf4d8d75d8aba537a19b313a9364fd08ddbd5622","lessThan":"07aa4a8ebacde3d0ba50f60d2964f274ee7629bc","versionType":"git","status":"affected"},{"version":"cf4d8d75d8aba537a19b313a9364fd08ddbd5622","lessThan":"e037c1250cc90e7aacb002357d1b0399fc65ecfc","versionType":"git","status":"affected"},{"version":"cf4d8d75d8aba537a19b313a9364fd08ddbd5622","lessThan":"6b38a5b8ee951e5b244e9a3c3d28d0f5e7c51411","versionType":"git","status":"affected"},{"version":"cf4d8d75d8aba537a19b313a9364fd08ddbd5622","lessThan":"8614a8f7e81edd34c9f67e454e7024fd12a2a341","versionType":"git","status":"affected"},{"version":"cf4d8d75d8aba537a19b313a9364fd08ddbd5622","lessThan":"bb44a7690a4d553da705919cf666a80f5ca9011c","versionType":"git","status":"affected"},{"version":"cf4d8d75d8aba537a19b313a9364fd08ddbd5622","lessThan":"610a0d2a35496738e1472fb0f318d5008a1c634f","versionType":"git","status":"affected"},{"version":"cf4d8d75d8aba537a19b313a9364fd08ddbd5622","lessThan":"93612d48fa42b3d1a637eb9279e15281c611c000","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ocfs2/dlmglue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.26","status":"affected"},{"version":"0","lessThan":"2.6.26","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","s