The Device Model in ACRN up to and including 2.5 has a devicemodel/core/mem.c use-after-free for a freed rb_entry.
linux acrn