In the Linux kernel, the following vulnerability has been resolved:

media: chips-media: wave5: Release m2m ctx after Instance Removed from List

Possible use after free if IRQ thread manages to obtain spinlock between m2m ctx release and wave5 release function removing stream instance from list of active instances. The IRQ thread looks for the m2m ctx which is freed so null pointer dereference occurs.