In the Linux kernel, the following vulnerability has been resolved:
io_uring: Fix release of pinned pages when __io_uaddr_map fails
Looking at the error path of __io_uaddr_map, if we fail after pinning
the pages for any reasons, ret will be set to -EINVAL and the error
handler wonβt properly release the pinned pages.
I didnβt manage to trigger it without forcing a failure, but it can
happen in real life when memory is heavily fragmented.