In the Linux kernel, the following vulnerability has been resolved:
RDMA/hns: Fix UAF for cq async event
The refcount of CQ is not protected by locks. When CQ asynchronous events and CQ destruction are concurrent, CQ may have been released, which will cause UAF.
Use the xa_lock() to protect the CQ refcount.
[
    {
        "signature_type": "Function",
        "target": {
            "function": "hns_roce_cq_event",
            "file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63da190eeb5c9d849b71f457b15b308c94cbaf08",
        "deprecated": false,
        "id": "CVE-2024-38545-04d64163",
        "signature_version": "v1",
        "digest": {
            "length": 847.0,
            "function_hash": "328878566101971031380963060930519500598"
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@763780ef0336a973e933e40e919339381732dcaf",
        "deprecated": false,
        "id": "CVE-2024-38545-07d6e148",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "150022146586092114269707316884980129780",
                "259941816791018425212685857027050051948",
                "276800501565421088578629671510982685516",
                "239190705403133340188607436109003807809",
                "190051088301258399164306633145336614831",
                "304252279091863824723824885022675737270",
                "306957690602838235968643174911392098326",
                "223131489566736076260270519701500264451",
                "139540493965301801046541700236092571536",
                "254818285379337730250349269302644899405",
                "141214421279169041937596814957599801352",
                "164694525217484956357358021065645693872",
                "319123262897697405738387845306487558977",
                "125220963372482319463386032128221709522",
                "263978852273211167390618627560776733805",
                "165553670562746577262184884104251137693",
                "102215822090716214357700884425175048447",
                "56093461386659495513089494323300453641",
                "153670263383740452924910729855204841953",
                "57753656654212471562298635357545817033",
                "252014924186175087152474274299008756641",
                "103721942702782881956169269642528108566",
                "257588518837618652319229768443188487496",
                "314451737949647559613163793774694710688",
                "124566429858265701757663837572967243809"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37a7559dc1358a8d300437e99ed8ecdab0671507",
        "deprecated": false,
        "id": "CVE-2024-38545-1cd108fb",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "150022146586092114269707316884980129780",
                "259941816791018425212685857027050051948",
                "276800501565421088578629671510982685516",
                "239190705403133340188607436109003807809",
                "190051088301258399164306633145336614831",
                "304252279091863824723824885022675737270",
                "306957690602838235968643174911392098326",
                "223131489566736076260270519701500264451",
                "139540493965301801046541700236092571536",
                "254818285379337730250349269302644899405",
                "141214421279169041937596814957599801352",
                "164694525217484956357358021065645693872",
                "319123262897697405738387845306487558977",
                "125220963372482319463386032128221709522",
                "263978852273211167390618627560776733805",
                "165553670562746577262184884104251137693",
                "102215822090716214357700884425175048447",
                "56093461386659495513089494323300453641",
                "153670263383740452924910729855204841953",
                "57753656654212471562298635357545817033",
                "252014924186175087152474274299008756641",
                "103721942702782881956169269642528108566",
                "257588518837618652319229768443188487496",
                "314451737949647559613163793774694710688",
                "124566429858265701757663837572967243809"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@330c825e66ef65278e4ebe57fd49c1d6f3f4e34e",
        "deprecated": false,
        "id": "CVE-2024-38545-2ad74982",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "293248199236357794556233487608275608497",
                "104122038226177879229016622689820046003",
                "276800501565421088578629671510982685516",
                "239190705403133340188607436109003807809",
                "249956381376266935573820491825269595914",
                "304252279091863824723824885022675737270",
                "306957690602838235968643174911392098326",
                "279991319767966257285084652006119712232",
                "139540493965301801046541700236092571536",
                "254818285379337730250349269302644899405",
                "141214421279169041937596814957599801352",
                "164694525217484956357358021065645693872",
                "319123262897697405738387845306487558977",
                "125220963372482319463386032128221709522",
                "263978852273211167390618627560776733805",
                "165553670562746577262184884104251137693",
                "102215822090716214357700884425175048447",
                "56093461386659495513089494323300453641",
                "153670263383740452924910729855204841953",
                "57753656654212471562298635357545817033",
                "252014924186175087152474274299008756641",
                "103721942702782881956169269642528108566",
                "257588518837618652319229768443188487496",
                "314451737949647559613163793774694710688",
                "124566429858265701757663837572967243809"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a942ec2745ca864cd8512142100e4027dc306a42",
        "deprecated": false,
        "id": "CVE-2024-38545-31bd40df",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "150022146586092114269707316884980129780",
                "259941816791018425212685857027050051948",
                "276800501565421088578629671510982685516",
                "239190705403133340188607436109003807809",
                "190051088301258399164306633145336614831",
                "304252279091863824723824885022675737270",
                "306957690602838235968643174911392098326",
                "223131489566736076260270519701500264451",
                "139540493965301801046541700236092571536",
                "254818285379337730250349269302644899405",
                "141214421279169041937596814957599801352",
                "164694525217484956357358021065645693872",
                "319123262897697405738387845306487558977",
                "125220963372482319463386032128221709522",
                "263978852273211167390618627560776733805",
                "165553670562746577262184884104251137693",
                "102215822090716214357700884425175048447",
                "56093461386659495513089494323300453641",
                "153670263383740452924910729855204841953",
                "57753656654212471562298635357545817033",
                "252014924186175087152474274299008756641",
                "103721942702782881956169269642528108566",
                "257588518837618652319229768443188487496",
                "314451737949647559613163793774694710688",
                "124566429858265701757663837572967243809"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "function": "hns_roce_cq_event",
            "file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@763780ef0336a973e933e40e919339381732dcaf",
        "deprecated": false,
        "id": "CVE-2024-38545-3441cc5a",
        "signature_version": "v1",
        "digest": {
            "length": 847.0,
            "function_hash": "328878566101971031380963060930519500598"
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "function": "hns_roce_cq_event",
            "file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a942ec2745ca864cd8512142100e4027dc306a42",
        "deprecated": false,
        "id": "CVE-2024-38545-3f838857",
        "signature_version": "v1",
        "digest": {
            "length": 847.0,
            "function_hash": "328878566101971031380963060930519500598"
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39d26cf46306bdc7ae809ecfdbfeff5aa1098911",
        "deprecated": false,
        "id": "CVE-2024-38545-570bf2db",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "150022146586092114269707316884980129780",
                "259941816791018425212685857027050051948",
                "276800501565421088578629671510982685516",
                "239190705403133340188607436109003807809",
                "190051088301258399164306633145336614831",
                "304252279091863824723824885022675737270",
                "306957690602838235968643174911392098326",
                "223131489566736076260270519701500264451",
                "139540493965301801046541700236092571536",
                "254818285379337730250349269302644899405",
                "141214421279169041937596814957599801352",
                "164694525217484956357358021065645693872",
                "319123262897697405738387845306487558977",
                "125220963372482319463386032128221709522",
                "263978852273211167390618627560776733805",
                "165553670562746577262184884104251137693",
                "102215822090716214357700884425175048447",
                "56093461386659495513089494323300453641",
                "153670263383740452924910729855204841953",
                "57753656654212471562298635357545817033",
                "252014924186175087152474274299008756641",
                "103721942702782881956169269642528108566",
                "257588518837618652319229768443188487496",
                "314451737949647559613163793774694710688",
                "124566429858265701757663837572967243809"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "function": "hns_roce_cq_event",
            "file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@330c825e66ef65278e4ebe57fd49c1d6f3f4e34e",
        "deprecated": false,
        "id": "CVE-2024-38545-5c1a5d46",
        "signature_version": "v1",
        "digest": {
            "length": 847.0,
            "function_hash": "328878566101971031380963060930519500598"
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63da190eeb5c9d849b71f457b15b308c94cbaf08",
        "deprecated": false,
        "id": "CVE-2024-38545-6511a89e",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "150022146586092114269707316884980129780",
                "259941816791018425212685857027050051948",
                "276800501565421088578629671510982685516",
                "239190705403133340188607436109003807809",
                "190051088301258399164306633145336614831",
                "304252279091863824723824885022675737270",
                "306957690602838235968643174911392098326",
                "223131489566736076260270519701500264451",
                "139540493965301801046541700236092571536",
                "254818285379337730250349269302644899405",
                "141214421279169041937596814957599801352",
                "164694525217484956357358021065645693872",
                "319123262897697405738387845306487558977",
                "125220963372482319463386032128221709522",
                "263978852273211167390618627560776733805",
                "165553670562746577262184884104251137693",
                "102215822090716214357700884425175048447",
                "56093461386659495513089494323300453641",
                "153670263383740452924910729855204841953",
                "57753656654212471562298635357545817033",
                "252014924186175087152474274299008756641",
                "103721942702782881956169269642528108566",
                "257588518837618652319229768443188487496",
                "314451737949647559613163793774694710688",
                "124566429858265701757663837572967243809"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "function": "hns_roce_cq_event",
            "file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39d26cf46306bdc7ae809ecfdbfeff5aa1098911",
        "deprecated": false,
        "id": "CVE-2024-38545-a20b04d3",
        "signature_version": "v1",
        "digest": {
            "length": 847.0,
            "function_hash": "328878566101971031380963060930519500598"
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "function": "hns_roce_cq_event",
            "file": "drivers/infiniband/hw/hns/hns_roce_cq.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37a7559dc1358a8d300437e99ed8ecdab0671507",
        "deprecated": false,
        "id": "CVE-2024-38545-d432a82d",
        "signature_version": "v1",
        "digest": {
            "length": 847.0,
            "function_hash": "328878566101971031380963060930519500598"
        }
    }
]