In the Linux kernel, the following vulnerability has been resolved: dma-buf/syncfile: Don't leak fences on merge failure Each addfence() call does a dmafenceget() on the relevant fence. In the error path, we weren't calling dmafenceput() so all those fences got leaked. Also, in the kreallocarray failure case, we weren't freeing the fences array. Instead, ensure that i and fences are always zero-initialized and dmafence_put() all the fences and kfree(fences) on every error path.