CVE-2026-53190

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix dmafence refcount leak on error in virtiogpudmafence_wait()

dmafenceunwrapforeach() internally calls dmafenceunwrapfirst() which does cursor->chain = dmafenceget(head), taking an extra reference. On normal loop completion, dmafenceunwrapnext() releases this via dmafencechainwalk() -> dmafence_put().

When virtiogpudofencewait() fails and the function returns early from inside the loop, the cursor->chain reference is never released. This is the only caller in the entire kernel that does an early return inside dmafenceunwrapforeach.

Add dmafenceput(itr.chain) before the early return.