In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix use-after-free race in sample_restore_put()

Concurrent teardown of TC sample rules sharing the same restore
context may re-read restore->count after dropping restore_lock.
At that point another thread may already have completed cleanup and
freed the restore object.

Use the result of the refcount decrement while holding restore_lock to
determine whether cleanup is needed.