In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst() On the error path where in6devget(dev) returns NULL, xfrm6filldst() releases the device reference with netdevput() but leaves xdst->u.dst.dev set. dstdestroy() later calls netdevput(dst->dev) again, so the same netdevice reference is released twice, underflowing its refcount (reftracker WARNING + "unregisternetdevice: waiting for <dev> to become free"). Clear xdst->u.dst.dev after the netdevput(), the same way the XFRM device-offload paths xfrmdevstateadd() and xfrmdevpolicyadd() in net/xfrm/xfrmdevice.c NULL ->dev when releasing the reference on error. reftracker: reference already released. reftracker: allocated in: xfrm6filldst (net/ipv6/xfrm6policy.c:86) ... udpv6sendmsg (net/ipv6/udp.c:1696) ... reftracker: freed in: xfrm6filldst (net/ipv6/xfrm6policy.c:90) ... WARNING: lib/reftracker.c:322 at reftrackerfree+0x58b/0x780 dstdestroy (net/core/dst.c:115) rcucore handle_softirqs ...