In the Linux kernel, the following vulnerability has been resolved: IB/cm: Drop lockdep assert and WARN when freeing old msg The send completion handler can run after cm_id has advanced to another message. The cm_id lock is not needed in this case, but a recent change re-used cm_free_priv_msg(), which asserts that the lock is held and WARNs if the cm_id's currently outstanding msg is different than the one being freed.
https://git.kernel.org/stable/c/fc096a0cd2017cb0aa1e7fb83131410af9283910
https://git.kernel.org/stable/c/7590649ee7af381a9d1153143026dec124c5798e