In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: Clean dangling pointer on bind error path
mtkdrmbind() can fail, in which case drmdevput() is called, destroying the drmdevice object. However a pointer to it was still being held in the private object, and that pointer would be passed along to DRM in mtkdrmsysprepare() if a suspend were triggered at that point, resulting in a panic. Clean the pointer when destroying the object in the error path to prevent this from happening.