CVE-2026-98609: drm/virtio: fix object leak when drm_gem_handle_create() fails

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix object leak when drmgemhandlecreate() fails

virtiogpugemcreate() owns the reference taken by virtiogpuobjectcreate(). On the drmgemhandlecreate() error path it calls drmgemobjectrelease() instead of dropping that reference.

drmgemobjectrelease() is the inverse of drmgemobjectinit() and does not touch the reference count or call obj->funcs->free(), so it is only correct as the last step of a destructor, as in virtiogpucleanupobject(). Using it here leaves the bo at refcount 1 with no remaining reference, so virtiogpufreeobject() never runs and the shmem pages, sg table and virtiogpuobject are leaked. Since virtiogpuobjectcreate() has already set bo->created, VIRTIOGPUCMDRESOURCEUNREF is not queued either, leaking the host-side resource and the resource id.

drmgemhandlecreatetail() drops the handle reference on all of its internal error paths, so the caller only has to drop its own. Use drmgemobjectput(), matching the success path below.