In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.
- https://usn.ubuntu.com/3932-1/
- https://www.exploit-db.com/exploits/46388/
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Sec20-Paper310/Paper310