In the Linux kernel, the following vulnerability has been resolved:
ipv6/addrconf: fix a potential refcount underflow for idev
Now in addrconfmodrstimer(), reference idev depends on whether rstimer is not pending. Then modify rs_timer timeout.
There is a time gap in [1], during which if the pending rstimer becomes not pending. It will miss to hold idev, but the rstimer is activated. Thus rstimer callback function addrconfrs_timer() will be executed and put idev later without holding idev. A refcount underflow issue for idev can be caused by this.
if (!timer_pending(&idev->rs_timer))
in6_dev_hold(idev);
<--------------[1]
mod_timer(&idev->rs_timer, jiffies + when);
To fix the issue, hold idev if mod_timer() return 0.