Riskcovery

CVE-2021-47657

drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free()

State
Published
Severity
5.5 Medium
Published
Feb 26, 2025
Updated
May 23, 2026
Reserved
Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free()

If virtio_gpu_object_shmem_init() fails (e.g. due to fault injection, as it happened in the bug report by syzbot), virtio_gpu_array_put_free() could be called with objs equal to NULL.

Ensure that objs is not NULL in virtio_gpu_array_put_free(), or otherwise return from the function.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 377f8331d0565e6f71ba081c894029a92d0c7e77 to before b094fece3810c71ceee6f0921676cb65d4e68c5aAffected
  • 377f8331d0565e6f71ba081c894029a92d0c7e77 to before ac92b474eeeed75b8660374ba1d129a121c09da8Affected
  • 377f8331d0565e6f71ba081c894029a92d0c7e77 to before abc9ad36df16e27ac1c665085157f1a082d39bacAffected
  • 377f8331d0565e6f71ba081c894029a92d0c7e77 to before 6b79f96f4a23846516e5e6e4dd37fc06f43a60ddAffected
  • 244dbb4abe123779ec30e7c6ca283a681aba5c94Affected
  • 1016c0f62f73d5d2c3a5d1ad1e1fb0cdce1993aeAffected
  • 5.11.20 to before 5.12Affected
  • 5.12.3 to before 5.13Affected
LinuxLinux
  • 5.13Affected
  • before 5.13Not affected
  • 5.15.32 through 5.15.*Not affected
  • 5.16.18 through 5.16.*Not affected
  • 5.17.1 through 5.17.*Not affected
  • 5.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.