In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: Fix gem reference leak in validate_init()

On the ttm_bo_reserve() failure and "vma not found" error paths, the
loop breaks without adding the looked-up object to any validate list,
so the reference taken by drm_gem_object_lookup() is never released;
validate_fini() only walks the spliced lists.  Drop the reference
before breaking out on both paths.