In the Linux kernel, the following vulnerability has been resolved: watchdog: sc520wdt: Fix possible use-after-free in wdtturnoff() This module's remove path calls deltimer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling deltimer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself.