In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix user-after-free
This uses l2capchanholdunlesszero() after calling _l2capgetchanblah() to prevent the following trace:
Bluetooth: l2capcore.c:static void l2capchan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d
BUG: KASAN: use-after-free in _mutexwaiterisfirst kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in _mutexlockcommon kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in _mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389