In the Linux kernel, the following vulnerability has been resolved:
rbd: avoid use-after-free in dorbdadd() when rbddevcreate() fails
If getting an ID or setting up a work queue in rbddevcreate() fails, use-after-free on rbddev->rbdclient, rbddev->spec and rbddev->opts is triggered in dorbdadd(). The root cause is that the ownership of these structures is transfered to rbddev prematurely and they all end up getting freed when rbddevcreate() calls rbddevfree() prior to returning to dorbd_add().
Found by Linux Verification Center (linuxtesting.org) with SVACE, an incomplete patch submitted by Natalia Petrova n.petrova@fintech.ru.