In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: release the GEM object on virtio gpu vram create() errors

virtio gpu vram create() frees the object with a bare kfree(vram) on both error paths after drm gem private object init() has run, and on the second one after drm gem create mmap offset() has linked obj->vma node into the device's VMA offset manager. The freed object stays in that interval tree, so a later lookup or insertion walks freed memory, and the dma resv and gpuva lock are never destroyed.

Call drm gem object release() before kfree() on both paths.