In the Linux kernel, the following vulnerability has been resolved:
iouring/eventfd: ensure ioeventfd_signal() defers another RCU period
ioeventfddosignal() is invoked from an RCU callback, but when dropping the reference to the ioevfd, it calls ioeventfdfree() directly if the refcount drops to zero. This isn't correct, as any potential freeing of the ioev_fd should be deferred another RCU grace period.
Just call ioeventfdput() rather than open-code the dec-and-test and free, which will correctly defer it another RCU grace period.