In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: fix UAF race in destroy queue cpsch

wait on destroy queue() drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use is being destroyed flag to serialize destruction.