The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow with resultant use-after-free issues if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c fs/pipe.c fs/splice.c include/linux/mm.h include/linux/pipe_fs_i.h kernel/trace/trace.c mm/gup.c and mm/hugetlb.c. It can occur with FUSE requests.