CVE-2026-80888

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: drop dma buf reference on foreign-fd prime import

ttm prime fd to handle() returns -ENOSYS when the imported fd's dma buf->ops do not match the ttm object device's ops, but does so without releasing the reference acquired by dma buf get(). Any unprivileged renderD client passing a non-vmwgfx prime fd through the DRM VMW GB SURFACE REF{, EXT} path leaks one dma buf reference per call and indefinitely pins the foreign exporter's GEM resources.

Funnel the error path through the existing dma buf put() so the reference is always dropped.