CVE-2021-47657

low-risk
Published 2025-02-26

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() If virtio_gpu_object_shmem_init() fails (e.g. due to fault injection, as it happened in the bug report by syzbot), virtio_gpu_array_put_free() could be called with objs equal to NULL. Ensure that objs is not NULL in virtio_gpu_array_put_free(), or otherwise return from the function.

Do I need to act?

-
0.05% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Linux

References (4)

Patch https://git.kernel.org/stable/c/6b79f96f4a23846516e5e6e4dd37fc06f43a60dd
Patch https://git.kernel.org/stable/c/abc9ad36df16e27ac1c665085157f1a082d39bac
Patch https://git.kernel.org/stable/c/ac92b474eeeed75b8660374ba1d129a121c09da8
Patch https://git.kernel.org/stable/c/b094fece3810c71ceee6f0921676cb65d4e68c5a
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal