Hmm, looks like it might be a use-after-free bug (6b is the slab's poison value): Christian> RAX: 6b6b6b6b6b6b6b6b Are you running with CONFIG_DEBUG_SLAB enabled? Also can you send the output of "objdump -d" on uverbs_mem.o from your kernel compile? - R.