In the Linux kernel, the following vulnerability has been resolved:

of/overlay: put property on deadprops only after changeset add succeeds

add changeset property() links a new property of a not-yet-live target node into the node's deadprops list before handing it to of changeset add property(). If that fails, the error path frees the property but leaves the freed pointer linked in deadprops, and of node release() frees it a second time when the aborted overlay's node is released.

Record the changeset entry first and link the property into deadprops only on success. of changeset add property() never looks at the node's property lists, so the order of the two steps is otherwise immaterial, and the error path frees a property that nothing references.