In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix outfput in iommufdfault_alloc()
As fput() calls the file->fop->release op, where fault obj and ictx are getting released, there is no need to release these two after fput() one more time, which would result in imbalanced refcounts: refcountt: decrement hit 0; leaking memory. WARNING: CPU: 48 PID: 2369 at lib/refcount.c:31 refcountwarnsaturate+0x60/0x230 Call trace: refcountwarnsaturate+0x60/0x230 (P) refcountwarnsaturate+0x60/0x230 (L) iommufdfaultfopsrelease+0x9c/0xe0 [iommufd] ... VFS: Close: file count is 0 (fop=iommufdfops [iommufd]) WARNING: CPU: 48 PID: 2369 at fs/open.c:1507 filpflush+0x3c/0xf0 Call trace: filpflush+0x3c/0xf0 (P) filpflush+0x3c/0xf0 (L) _arm64sysclose+0x34/0x98 ... imbalanced put on file reference count WARNING: CPU: 48 PID: 2369 at fs/file.c:74 _filerefput+0x100/0x138 Call trace: _filerefput+0x100/0x138 (P) _filerefput+0x100/0x138 (L) _fputsync+0x4c/0xd0
Drop those two lines to fix the warnings above.