In the Linux kernel, the following vulnerability has been resolved:
drm/plane: Move range check for format_count earlier
While the check for formatcount > 64 in _drmuniversalplaneinit() shouldn't be hit (it's a WARNON), in its current position it will then leak the plane->formattypes array and fail to call drmmodeobjectunregister() leaking the modeset identifier. Move it to the start of the function to avoid allocating those resources in the first place.