CVE-2021-47142

drm/amdgpu: Fix a use-after-free

State: Published
Severity: 7.8 High
Published: Mar 25, 2024
Updated: Aug 5, 2026
Reserved: Mar 4, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix a use-after-free

looks like we forget to set ttm->sg to NULL. Hit panic below

[ 1235.844104] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [ 1235.989074] Call Trace: [ 1235.991751] sg_free_table+0x17/0x20 [ 1235.995667] amdgpu_ttm_backend_unbind.cold+0x4d/0xf7 [amdgpu] [ 1236.002288] amdgpu_ttm_backend_destroy+0x29/0x130 [amdgpu] [ 1236.008464] ttm_tt_destroy+0x1e/0x30 [ttm] [ 1236.013066] ttm_bo_cleanup_memtype_use+0x51/0xa0 [ttm] [ 1236.018783] ttm_bo_release+0x262/0xa50 [ttm] [ 1236.023547] ttm_bo_put+0x82/0xd0 [ttm] [ 1236.027766] amdgpu_bo_unref+0x26/0x50 [amdgpu] [ 1236.032809] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x7aa/0xd90 [amdgpu] [ 1236.040400] kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu] [ 1236.046912] kfd_ioctl+0x463/0x690 [amdgpu]

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 0707c3fea8102d211631ba515ef2159707561b0dAffected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 3293cf3513d69f00c14d43e2020826d45ea0e46aAffected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 952ab3f9f48eb0e8050596d41951cf516be6b122Affected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before a849e218556f932576c0fb1c5a88714b61709a17Affected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 7398c2aab4da960761ec182d04d6d5abbb4a226eAffected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before f98cdf084405333ee2f5be548a91b2d168e49276Affected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before d4ea141fd4b40636a8326df5a377d9c5cf9b3faaAffected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 1e5c37385097c35911b0f8a0c67ffd10ee1af9a2Affected
LinuxLinux	4.2Affected before 4.2Not affected 4.4.271 through 4.4.Not affected 4.9.271 through 4.9.Not affected 4.14.235 through 4.14.Not affected 4.19.193 through 4.19.Not affected 5.4.124 through 5.4.Not affected 5.10.42 through 5.10.Not affected 5.12.9 through 5.12.*Not affected 5.13 and laterNot affected

Product

Versions

LinuxLinux

d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 0707c3fea8102d211631ba515ef2159707561b0dAffected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 3293cf3513d69f00c14d43e2020826d45ea0e46aAffected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 952ab3f9f48eb0e8050596d41951cf516be6b122Affected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before a849e218556f932576c0fb1c5a88714b61709a17Affected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 7398c2aab4da960761ec182d04d6d5abbb4a226eAffected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before f98cdf084405333ee2f5be548a91b2d168e49276Affected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before d4ea141fd4b40636a8326df5a377d9c5cf9b3faaAffected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 1e5c37385097c35911b0f8a0c67ffd10ee1af9a2Affected

LinuxLinux

4.2Affected
before 4.2Not affected
4.4.271 through 4.4.*Not affected
4.9.271 through 4.9.*Not affected
4.14.235 through 4.14.*Not affected
4.19.193 through 4.19.*Not affected
5.4.124 through 5.4.*Not affected
5.10.42 through 5.10.*Not affected
5.12.9 through 5.12.*Not affected
5.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.