CVE-2026-98319

In the Linux kernel, the following vulnerability has been resolved:

drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr

When an out_fence_ptr is provided but DRM_MODE_PAGE_FLIP_EVENT is not

set, a drm_pending_vblank_event will be allocated. If later, there is an

allocation failure or another failure at setup_out_fence(), that event

will not have base.fence set and it will not be released at

complete_signaling().

Release the event and set crtc_state->event to NULL just like in the

DRM_MODE_PAGE_FLIP_EVENT case when there is a failure at

drm_event_reserve_init(). That is, prepare_signaling() releases the

event and there is nothing to be done at complete_signaling(). Use

drm_event_cancel_free() as that will also undo drm_event_reserve_init()

in case it has been called.