In the Linux kernel, the following vulnerability has been resolved: kernfs: Relax constraint in draining guard The active reference lifecycle provides the break/unbreak mechanism but the active reference is not truly active after unbreak -- callers don't use it afterwards but it's important for proper pairing of kn->active counting. Assuming this mechanism is in place, the WARN check in kernfsshoulddrainopenfiles() is too sensitive -- it may transiently catch those (rightful) callers between kernfsunbreakactiveprotection() and kernfsputactive() as found out by Chen Ridong: kernfsremovebynamens kernfsgetactive // active=1 _kernfsremove // active=0x80000002 kernfsdrain ... waitevent //waiting (active == 0x80000001) kernfsbreakactiveprotection // active = 0x80000001 // continue kernfsunbreakactiveprotection // active = 0x80000002 ... kernfsshoulddrainopenfiles // warning occurs kernfsputactive To avoid the false positives (mind panicon_warn) remove the check altogether. (This is meant as quick fix, I think active reference break/unbreak may be simplified with larger rework.)