On Mon, Mar 10, 2025 at 03:37:51PM +0100, Vlastimil Babka wrote: > Note it's a 6.14 hotfix for kernel oopses due to page refcount overflow. Not actually overflow ... without VM_DEBUG enabled, networking increases the refcount from 0 to 1, then decrements it from 1 to 0, causing the slab to be freed. So it's a UAF bug induced by a messed-up refcount.
