In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a nonblocking atomic commit and a driver unload.
https://github.com/torvalds/linux/commit/4e076c73e4f6e90816b30fcd4a0d7ab365087255
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.5