In the Linux kernel, the following vulnerability has been resolved: _legitimizemnt(): check for MNTSYNCUMOUNT should be under mountlock ... or we risk stealing final mntput from sync umount - raising mntcount after umount(2) has verified that victim is not busy, but before it has set MNTSYNCUMOUNT; in that case _legitimizemnt() doesn't see that it's safe to quietly undo mntcount increment and leaves dropping the reference to caller, where it'll be a full-blown mntput(). Check under mountlock is needed; leaving the current one done before taking that makes no sense - it's nowhere near common enough to bother with.