In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: Fix gem reference leak in validate init()

On the ttm bo reserve() failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drm gem object lookup() is never released; validate fini() only walks the spliced lists. Drop the reference before breaking out on both paths.