From 4041aae3b8eeb73c259b6a429e0c7573193865fa Mon Sep 17 00:00:00 2001
From: Sergey Miryanov <sergey.miryanov@gmail.com>
Date: Sun, 18 Oct 2026 23:40:21 +0500
Subject: [PATCH 1/4] Set GC_FINALIZED before calling tp_finalize

---
 Objects/object.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Objects/object.c b/Objects/object.c
index e334097d31c4325..6cf0795a31c4c15 100644
--- a/Objects/object.c
+++ b/Objects/object.c
@@ -583,13 +583,13 @@ PyObject_CallFinalizer(PyObject *self)
     if (tp->tp_finalize == NULL)
         return;
     /* tp_finalize should only be called once. */
-    if (_PyType_IS_GC(tp) && _PyGC_FINALIZED(self))
-        return;
-
-    tp->tp_finalize(self);
     if (_PyType_IS_GC(tp)) {
+        if (_PyGC_FINALIZED(self))
+            return;
+
         _PyGC_SET_FINALIZED(self);
     }
+    tp->tp_finalize(self);
 }
 
 int

From e0e5535cf3795384f4910b9ecd0a51f25c046e93 Mon Sep 17 00:00:00 2001
From: Sergey Miryanov <sergey.miryanov@gmail.com>
Date: Tue, 20 Oct 2026 20:09:48 +0500
Subject: [PATCH 2/4] Re-extract the type of self after calling tp_finalize

---
 Objects/typeobject.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 5e772e5608d4c66..ccab26b66c0c7e4 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -2771,6 +2771,10 @@ subtype_dealloc(PyObject *self)
         }
         _PyObject_GC_UNTRACK(self);
     }
+
+    /* Extract the type again; tp_finalize may have changed it */
+    type = Py_TYPE(self);
+
     /*
       If we added a weaklist, we clear it. Do this *before* calling tp_del,
       clearing slots, or clearing the instance dict.

From 7a24d33fa3175af09662cb487df317c3df98d86f Mon Sep 17 00:00:00 2001
From: Sergey Miryanov <sergey.miryanov@gmail.com>
Date: Tue, 20 Oct 2026 20:40:38 +0500
Subject: [PATCH 3/4] Add news

---
 .../2026-10-20-20-38-38.gh-issue-159101.vFwrZY.rst              | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-20-38-38.gh-issue-159101.vFwrZY.rst

diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-20-38-38.gh-issue-159101.vFwrZY.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-20-38-38.gh-issue-159101.vFwrZY.rst
new file mode 100644
index 000000000000000..fa42d92210e3299
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-20-38-38.gh-issue-159101.vFwrZY.rst
@@ -0,0 +1,2 @@
+Fix use-after-free when ``!tp_finalize`` changes the base class. Patch by
+Sergey Miryanov.

From 5dfc9ea0fe33e047f534985e501f7d9c253b8c08 Mon Sep 17 00:00:00 2001
From: Sergey Miryanov <sergey.miryanov@gmail.com>
Date: Tue, 20 Oct 2026 21:15:46 +0500
Subject: [PATCH 4/4] Update
 Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-20-38-38.gh-issue-159101.vFwrZY.rst

Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
---
 .../2026-10-20-20-38-38.gh-issue-159101.vFwrZY.rst              | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-20-38-38.gh-issue-159101.vFwrZY.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-20-38-38.gh-issue-159101.vFwrZY.rst
index fa42d92210e3299..33beb8d571d7eca 100644
--- a/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-20-38-38.gh-issue-159101.vFwrZY.rst
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-20-20-38-38.gh-issue-159101.vFwrZY.rst
@@ -1,2 +1,2 @@
-Fix use-after-free when ``!tp_finalize`` changes the base class. Patch by
+Fix use-after-free when :meth:`~object.__del__` changes the base class. Patch by
 Sergey Miryanov.