In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: fix refcount bug in iwpm get nlmsg request()

iwpm get nlmsg request() initializes refcount after list add tail() making it accessible to global list where another CPU can kref get() on nlmsg request causing a refcount "addition on 0" bug. Fix this by initializing kref before list add tail() so refcount for nlmsg request can be incremented/decremented normally. In addition, also initialize every field before list add tail().