CVE-2021-47280: Linux Kernel

High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free read in drm_getunique() There is a time-of-check-to-time-of-use error in drm_getunique() due to retrieving file_priv->master prior to locking the device's master mutex. An example can be seen in the crash report of the use-after-free error found by Syzbot: https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803 In the report, the master pointer was used after being freed. This is because another process had acquired the device's master mutex in drm_setmaster_ioctl(), then overwrote fpriv->master in drm_new_set_master(). The old value of fpriv->master was subsequently freed before the mutex was unlocked. To fix this, we lock the device's master mutex before retrieving the pointer from from fpriv->master. This patch passes the Syzbot reproducer test.

Affected products

• Linux Linux Kernel: before 4.14.237 (fixed in 4.14.237); from 4.15, before 4.19.195 (fixed in 4.19.195); from 4.20, before 5.4.126 (fixed in 5.4.126); from 5.5, before 5.10.44 (fixed in 5.10.44); from 5.11, before 5.12.11 (fixed in 5.12.11); version 5.13 only

Published 2024-05-21. Last modified 2026-06-17.