In the Linux kernel, the following vulnerability has been resolved: afs: Fix lock recursion afswakeupasynccall() can incur lock recursion. The problem is that it is called from AFRXRPC whilst holding the ->notifylock, but it tries to take a ref on the afscall struct in order to pass it to a work queue - but if the afscall is already queued, we then have an extraneous ref that must be put... calling afsputcall() may call back down into AFRXRPC through rxrpckernelshutdowncall(), however, which might try taking the ->notifylock again. This case isn't very common, however, so defer it to a workqueue. The oops looks something like: BUG: spinlock recursion on CPU#0, krxrpcio/7001/1646 lock: 0xffff888141399b30, .magic: dead4ead, .owner: krxrpcio/7001/1646, .ownercpu: 0 CPU: 0 UID: 0 PID: 1646 Comm: krxrpcio/7001 Not tainted 6.12.0-rc2-build3+ #4351 Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 Call Trace: <TASK> dumpstacklvl+0x47/0x70 dorawspinlock+0x3c/0x90 rxrpckernelshutdowncall+0x83/0xb0 afsputcall+0xd7/0x180 rxrpcnotifysocket+0xa0/0x190 rxrpcinputsplitjumbo+0x198/0x1d0 rxrpcinputdata+0x14b/0x1e0 ? rxrpcinputcallpacket+0xc2/0x1f0 rxrpcinputcallevent+0xad/0x6b0 rxrpcinputpacketonconn+0x1e1/0x210 rxrpcinputpacket+0x3f2/0x4d0 rxrpciothread+0x243/0x410 ? _pfxrxrpciothread+0x10/0x10 kthread+0xcf/0xe0 ? _pfxkthread+0x10/0x10 retfromfork+0x24/0x40 ? _pfxkthread+0x10/0x10 retfromforkasm+0x1a/0x30 </TASK>