CVE-2021-47533 (GCVE-0-2021-47533)

Vulnerability from cvelistv5 – Published: 2024-05-24 15:09 – Updated: 2026-08-05 08:48
VLAI
Title
drm/vc4: kms: Clear the HVS FIFO commit pointer once done
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: kms: Clear the HVS FIFO commit pointer once done Commit 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a commit") introduced a wait on the previous commit done on a given HVS FIFO. However, we never cleared that pointer once done. Since drm_crtc_commit_put can free the drm_crtc_commit structure directly if we were the last user, this means that it can lead to a use-after free if we were to duplicate the state, and that stale pointer would even be copied to the new state. Set the pointer to NULL once we're done with the wait so that we don't carry over a pointer to a free'd structure.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-24 19:17 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9ec03d7f1ed394897891319a4dda75f52c5d292d , < 2931db9a5ed219546cf2ae0546698faf78281b89 (git)
Affected: 9ec03d7f1ed394897891319a4dda75f52c5d292d , < d134c5ff71c7f2320fc7997f2fbbdedf0c76889a (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 5.15.7 , ≤ 5.15.* (semver)
Unaffected: 5.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47533",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-24T19:17:49.041066Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:15:00.137Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.620Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2931db9a5ed219546cf2ae0546698faf78281b89"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d134c5ff71c7f2320fc7997f2fbbdedf0c76889a"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vc4/vc4_kms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2931db9a5ed219546cf2ae0546698faf78281b89",
              "status": "affected",
              "version": "9ec03d7f1ed394897891319a4dda75f52c5d292d",
              "versionType": "git"
            },
            {
              "lessThan": "d134c5ff71c7f2320fc7997f2fbbdedf0c76889a",
              "status": "affected",
              "version": "9ec03d7f1ed394897891319a4dda75f52c5d292d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vc4/vc4_kms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.7",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: kms: Clear the HVS FIFO commit pointer once done\n\nCommit 9ec03d7f1ed3 (\"drm/vc4: kms: Wait on previous FIFO users before a\ncommit\") introduced a wait on the previous commit done on a given HVS\nFIFO.\n\nHowever, we never cleared that pointer once done. Since\ndrm_crtc_commit_put can free the drm_crtc_commit structure directly if\nwe were the last user, this means that it can lead to a use-after free\nif we were to duplicate the state, and that stale pointer would even be\ncopied to the new state.\n\nSet the pointer to NULL once we\u0027re done with the wait so that we don\u0027t\ncarry over a pointer to a free\u0027d structure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through DRM atomic modeset ioctls (DRM_IOCTL_MODE_ATOMIC \u2192 vc4_atomic_commit_setup/tail) on the local VC4 DRM device (/dev/dri/cardN), not via network packet processing.\nAC:L - An attacker who can issue atomic commits fully controls the commit sequence that drops the last drm_crtc_commit reference and then duplicates HVS state, so the stale-pointer UAF is reliably triggerable without depending on external conditions.\nPR:L - Atomic commits require DRM master, but mastership is obtainable without CAP_SYS_ADMIN by the first opener of the primary node, a logind session user, or a DRM lease client\u2014common for unprivileged video-group users on Raspberry Pi/embedded systems.\nUI:N - The attacker triggers the vulnerability directly by issuing their own atomic commit ioctls; no separate victim action is required.\nS:U - Successful exploitation affects the local kernel/host authority only (privilege escalation or crash within the same OS instance), with no VM/IOMMU/sandbox boundary crossed.\nC:H - This is a use-after-free of drm_crtc_commit that is re-referenced via drm_crtc_commit_get on state duplication, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - UAF of a kmalloc\u0027d drm_crtc_commit object enables heap reuse and control-flow hijacking primitives, supporting arbitrary kernel write / code execution.\nA:H - Use of the freed commit pointer (wait/get/put paths) can cause kernel oops, hang, or panic, so availability impact is high even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:48:15.580Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2931db9a5ed219546cf2ae0546698faf78281b89"
        },
        {
          "url": "https://git.kernel.org/stable/c/d134c5ff71c7f2320fc7997f2fbbdedf0c76889a"
        }
      ],
      "title": "drm/vc4: kms: Clear the HVS FIFO commit pointer once done",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47533",
    "datePublished": "2024-05-24T15:09:42.683Z",
    "dateReserved": "2024-05-24T15:02:54.826Z",
    "dateUpdated": "2026-08-05T08:48:15.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47533",
      "date": "2026-09-28",
      "epss": "0.00216",
      "percentile": "0.10835"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: kms: Clear the HVS FIFO commit pointer once done\n\nCommit 9ec03d7f1ed3 (\"drm/vc4: kms: Wait on previous FIFO users before a\ncommit\") introduced a wait on the previous commit done on a given HVS\nFIFO.\n\nHowever, we never cleared that pointer once done. Since\ndrm_crtc_commit_put can free the drm_crtc_commit structure directly if\nwe were the last user, this means that it can lead to a use-after free\nif we were to duplicate the state, and that stale pointer would even be\ncopied to the new state.\n\nSet the pointer to NULL once we\u0027re done with the wait so that we don\u0027t\ncarry over a pointer to a free\u0027d structure."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/vc4: kms: borre el puntero de commit FIFO de HVS una vez realizado. El commit 9ec03d7f1ed3 (\"drm/vc4: kms: espere a los usuarios FIFO anteriores antes de una confirmaci\u00f3n\") introdujo una espera en el commit anterior realizada en un HVS FIFO determinado. Sin embargo, nunca borramos ese puntero una vez hecho. Dado que drm_crtc_commit_put puede liberar la estructura drm_crtc_commit directamente si fu\u00e9ramos el \u00faltimo usuario, esto significa que puede llevar a un  use-after free si duplic\u00e1ramos el estado, y ese puntero obsoleto incluso se copiar\u00eda al nuevo estado. Establezca el puntero en NULL una vez que hayamos terminado con la espera para que no transfiramos un puntero a una estructura liberada."
        }
      ],
      "id": "CVE-2021-47533",
      "lastModified": "2024-11-21T06:36:28.440",
      "published": "2024-05-24T15:15:16.773",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/2931db9a5ed219546cf2ae0546698faf78281b89"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/d134c5ff71c7f2320fc7997f2fbbdedf0c76889a"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/2931db9a5ed219546cf2ae0546698faf78281b89"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/d134c5ff71c7f2320fc7997f2fbbdedf0c76889a"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/vc4/vc4_kms.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2931db9a5ed219546cf2ae0546698faf78281b89",
                    "status": "affected",
                    "version": "9ec03d7f1ed394897891319a4dda75f52c5d292d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d134c5ff71c7f2320fc7997f2fbbdedf0c76889a",
                    "status": "affected",
                    "version": "9ec03d7f1ed394897891319a4dda75f52c5d292d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/vc4/vc4_kms.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.12"
                  },
                  {
                    "lessThan": "5.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.16",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6FE5F0C4-AE43-4DD0-ADAB-1090889867A3",
                    "versionEndExcluding": "5.15.7",
                    "versionStartIncluding": "5.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "357AA433-37E8-4323-BFB2-3038D6E4B414",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "A73429BA-C2D9-4D0C-A75F-06A1CA8B3983",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F621B5E3-E99D-49E7-90B9-EC3B77C95383",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: kms: Clear the HVS FIFO commit pointer once done\n\nCommit 9ec03d7f1ed3 (\"drm/vc4: kms: Wait on previous FIFO users before a\ncommit\") introduced a wait on the previous commit done on a given HVS\nFIFO.\n\nHowever, we never cleared that pointer once done. Since\ndrm_crtc_commit_put can free the drm_crtc_commit structure directly if\nwe were the last user, this means that it can lead to a use-after free\nif we were to duplicate the state, and that stale pointer would even be\ncopied to the new state.\n\nSet the pointer to NULL once we\u0027re done with the wait so that we don\u0027t\ncarry over a pointer to a free\u0027d structure."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/vc4: kms: borre el puntero de commit FIFO de HVS una vez realizado. El commit 9ec03d7f1ed3 (\"drm/vc4: kms: espere a los usuarios FIFO anteriores antes de una confirmaci\u00f3n\") introdujo una espera en el commit anterior realizada en un HVS FIFO determinado. Sin embargo, nunca borramos ese puntero una vez hecho. Dado que drm_crtc_commit_put puede liberar la estructura drm_crtc_commit directamente si fu\u00e9ramos el \u00faltimo usuario, esto significa que puede llevar a un  use-after free si duplic\u00e1ramos el estado, y ese puntero obsoleto incluso se copiar\u00eda al nuevo estado. Establezca el puntero en NULL una vez que hayamos terminado con la espera para que no transfiramos un puntero a una estructura liberada."
          }
        ],
        "id": "CVE-2021-47533",
        "lastModified": "2026-08-04T10:17:07.453",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47533",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-24T19:17:49.041066Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-24T15:15:16.773",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2931db9a5ed219546cf2ae0546698faf78281b89"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d134c5ff71c7f2320fc7997f2fbbdedf0c76889a"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2931db9a5ed219546cf2ae0546698faf78281b89"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d134c5ff71c7f2320fc7997f2fbbdedf0c76889a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:02:54+00:00",
      "cve": "CVE-2021-47533",
      "id": "CVE-2021-47533",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/vc4: kms: Clear the HVS FIFO commit pointer once done",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47533.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-11T02:37:24Z",
      "cve": "CVE-2021-47533",
      "id": "CVE-2021-47533",
      "initial_release_date": "2024-05-28T15:29:40Z",
      "product_status:known_affected": "275",
      "product_status:known_not_affected": "266",
      "product_status:recommended": "452",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47533",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47533.json",
      "version": "58"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:39:59.620Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/2931db9a5ed219546cf2ae0546698faf78281b89"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/d134c5ff71c7f2320fc7997f2fbbdedf0c76889a"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47533",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-24T19:17:49.041066Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-24T19:17:54.736Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/vc4/vc4_kms.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "2931db9a5ed219546cf2ae0546698faf78281b89",
                  "status": "affected",
                  "version": "9ec03d7f1ed394897891319a4dda75f52c5d292d",
                  "versionType": "git"
                },
                {
                  "lessThan": "d134c5ff71c7f2320fc7997f2fbbdedf0c76889a",
                  "status": "affected",
                  "version": "9ec03d7f1ed394897891319a4dda75f52c5d292d",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/vc4/vc4_kms.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.12"
                },
                {
                  "lessThan": "5.12",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.7",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.16",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.7",
                      "versionStartIncluding": "5.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.16",
                      "versionStartIncluding": "5.12",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: kms: Clear the HVS FIFO commit pointer once done\n\nCommit 9ec03d7f1ed3 (\"drm/vc4: kms: Wait on previous FIFO users before a\ncommit\") introduced a wait on the previous commit done on a given HVS\nFIFO.\n\nHowever, we never cleared that pointer once done. Since\ndrm_crtc_commit_put can free the drm_crtc_commit structure directly if\nwe were the last user, this means that it can lead to a use-after free\nif we were to duplicate the state, and that stale pointer would even be\ncopied to the new state.\n\nSet the pointer to NULL once we\u0027re done with the wait so that we don\u0027t\ncarry over a pointer to a free\u0027d structure."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The bug is reached only through DRM atomic modeset ioctls (DRM_IOCTL_MODE_ATOMIC \u2192 vc4_atomic_commit_setup/tail) on the local VC4 DRM device (/dev/dri/cardN), not via network packet processing.\nAC:L - An attacker who can issue atomic commits fully controls the commit sequence that drops the last drm_crtc_commit reference and then duplicates HVS state, so the stale-pointer UAF is reliably triggerable without depending on external conditions.\nPR:L - Atomic commits require DRM master, but mastership is obtainable without CAP_SYS_ADMIN by the first opener of the primary node, a logind session user, or a DRM lease client\u2014common for unprivileged video-group users on Raspberry Pi/embedded systems.\nUI:N - The attacker triggers the vulnerability directly by issuing their own atomic commit ioctls; no separate victim action is required.\nS:U - Successful exploitation affects the local kernel/host authority only (privilege escalation or crash within the same OS instance), with no VM/IOMMU/sandbox boundary crossed.\nC:H - This is a use-after-free of drm_crtc_commit that is re-referenced via drm_crtc_commit_get on state duplication, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - UAF of a kmalloc\u0027d drm_crtc_commit object enables heap reuse and control-flow hijacking primitives, supporting arbitrary kernel write / code execution.\nA:H - Use of the freed commit pointer (wait/get/put paths) can cause kernel oops, hang, or panic, so availability impact is high even without full exploitation."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:48:15.580Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/2931db9a5ed219546cf2ae0546698faf78281b89"
            },
            {
              "url": "https://git.kernel.org/stable/c/d134c5ff71c7f2320fc7997f2fbbdedf0c76889a"
            }
          ],
          "title": "drm/vc4: kms: Clear the HVS FIFO commit pointer once done",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47533",
        "datePublished": "2024-05-24T15:09:42.683Z",
        "dateReserved": "2024-05-24T15:02:54.826Z",
        "dateUpdated": "2026-08-05T08:48:15.580Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.