CVE-2026-98609

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix object leak when drm gem handle create() fails

virtio gpu gem create() owns the reference taken by virtio gpu object create(). On the drm gem handle create() error path it calls drm gem object release() instead of dropping that reference.

drm gem object release() is the inverse of drm gem object init() and does not touch the reference count or call obj->funcs->free(), so it is only correct as the last step of a destructor, as in virtio gpu cleanup object(). Using it here leaves the bo at refcount 1 with no remaining reference, so virtio gpu free object() never runs and the shmem pages, sg table and virtio gpu object are leaked. Since virtio gpu object create() has already set bo->created, VIRTIO GPU CMD RESOURCE UNREF is not queued either, leaking the host-side resource and the resource id.

drm gem handle create tail() drops the handle reference on all of its internal error paths, so the caller only has to drop its own. Use drm gem object put(), matching the success path below.