A flaw use after free in the Linux Kernel found in fs/inode.c.
If security_inode_alloc fails, then in alloc_inode the inode_init_always could return -NOMEM.
In its error handling, i_callback and nilfs_free_inode will be called.
However, because inode->i_private is not initialized due to the failure of security_inode_alloc, the function nilfs_is_metadata_file_inode can return true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and leads to crash.

Reference:
https://lore.kernel.org/linux-fsdevel/20220816040859.659129-1-dzm91@hust.edu.cn/T/#u