In the Linux kernel, the following vulnerability has been resolved:
iouring/afunix: defer registered files gc to io_uring release
Instead of putting iouring's registered files in unixgc() we want it to be done by iouring itself. The trick here is to consider iouring registered files for cycle detection but not actually putting them down. Because iouring can't register other ring instances, this will remove all refs to the ring file triggering the ->release path and clean up with ioringctxfree().
[axboe: add kerneldoc comment to skb, fold in skb leak fix]