CVE-2026-98509: drm/virtio: fix memory leak of fence event on execbuffer failure

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix memory leak of fence event on execbuffer failure

virtiogpuexecbufferioctl() reserves a DRM event with drmeventreserveinit() when VIRTGPUEXECBUFRINGIDX selects a ring that userspace has enabled polling for. virtiogpuinitsubmit() does this before the BO handles, the command buffer, the syncobj arrays and the in-fence are processed, so every later error path runs with the event already pending, including plain argument validation failures such as an invalid bohandle or an in-syncobj that carries no fence.

On those paths, virtiogpucleanupsubmit() drops the out-fence without cancelling the event. The fence is freed without ever having been emitted, taking the only driver-side pointer to the event with it. Closing the DRM file does not help. drmeventsrelease() unlinks pending events but deliberately leaves the freeing to the driver's later drmsendevent(), which never runs for an orphaned event, so the allocation is leaked permanently.

Found when fuzzing the virtio driver with Syzkaller:

BUG: memory leak unreferenced object 0xffff88802c176e80 (size 96): comm "syz.1.367", pid 10561, jiffies 4294960122 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ c8 6e 17 2c 80 88 ff ff 00 00 00 00 00 00 00 00 .n.,............ backtrace (crc e1973c6b): kmemleakallocrecursive include/linux/kmemleak.h:44 [inline] slabpostallochook mm/slub.c:4597 [inline] slaballocnode mm/slub.c:4917 [inline] kmalloccachenoprof+0x49d/0x6f0 mm/slub.c:5485 kmallocnoprof include/linux/slab.h:988 [inline] kzallocnoprof include/linux/slab.h:1309 [inline] virtiogpufenceeventcreate drivers/gpu/drm/virtio/virtgpusubmit.c:282 [inline] virtiogpuinitsubmit drivers/gpu/drm/virtio/virtgpusubmit.c:398 [inline] virtiogpuexecbufferioctl+0xbbf/0x1aa0 drivers/gpu/drm/virtio/virtgpusubmit.c:505 drmioctlkernel+0x1f4/0x3e0 drivers/gpu/drm/drmioctl.c:817 drmioctl+0x5f4/0xc70 drivers/gpu/drm/drmioctl.c:914 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:597 [inline] sesysioctl fs/ioctl.c:583 [inline] x64sysioctl+0x18e/0x210 fs/ioctl.c:583 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0x116/0x800 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f

Fix by cancelling and freeing the DRM event on the execbuffer error path before dropping the fence. Clear the fence's event pointer after cancellation so it does not retain a dangling pointer.