In the Linux kernel, the following vulnerability has been resolved:

drm: Fix drm pending vblank event leak in error path for out fence ptr

When an out fence ptr is provided but DRM MODE PAGE FLIP EVENT is not set, a drm pending vblank event will be allocated. If later, there is an allocation failure or another failure at setup out fence(), that event will not have base.fence set and it will not be released at complete signaling().

Release the event and set crtc state->event to NULL just like in the DRM MODE PAGE FLIP EVENT case when there is a failure at drm event reserve init(). That is, prepare signaling() releases the event and there is nothing to be done at complete signaling(). Use drm event cancel free() as that will also undo drm event reserve init() in case it has been called.