{"id":"CVE-2021-47200","state":"PUBLISHED","title":"drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/prime: Fix use after free in mmap with drm_gem_ttm_mmap\n\ndrm_gem_ttm_mmap() drops a reference to the gem object on success. If\nthe gem object's refcount == 1 on entry to drm_gem_prime_mmap(), that\ndrop will free the gem object, and the subsequent drm_gem_object_get()\nwill be a UAF. Fix by grabbing a reference before calling the mmap\nhelper.\n\nThis issue was forseen when the reference dropping was adding in\ncommit 9786b65bc61ac (\"drm/ttm: fix mmap refcounting\"):\n  \"For that to work properly the drm_gem_object_get() call in\n  drm_gem_ttm_mmap() must be moved so it happens before calling\n  obj->funcs->mmap(), otherwise the gem refcount would go down\n  to zero.\"","publishedAt":"2024-04-10T18:56:35.152Z","updatedAt":"2026-08-05T08:46:41.297Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"9786b65bc61acec63f923978c75e707afbb74bc7","status":"affected","lessThan":"4f8e469a2384dfa4047145b0093126462cbb6dc0","versionType":"git"},{"version":"9786b65bc61acec63f923978c75e707afbb74bc7","status":"affected","lessThan":"8244a3bc27b3efd057da154b8d7e414670d5044f","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_prime.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.5","versionType":"semver"},{"version":"5.15.5","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_prime.c"]}],"references":["https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0","https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47200.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47200","state":"PUBLISHED","datePublished":"2024-04-10T18:56:35.152Z","dateUpdated":"2026-08-05T08:46:41.297Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-03-25T09:12:14.117Z"},"containers":{"cna":{"title":"drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/prime: Fix use after free in mmap with drm_gem_ttm_mmap\n\ndrm_gem_ttm_mmap() drops a reference to the gem object on success. If\nthe gem object's refcount == 1 on entry to drm_gem_prime_mmap(), that\ndrop will free the gem object, and the subsequent drm_gem_object_get()\nwill be a UAF. Fix by grabbing a reference before calling the mmap\nhelper.\n\nThis issue was forseen when the reference dropping was adding in\ncommit 9786b65bc61ac (\"drm/ttm: fix mmap refcounting\"):\n  \"For that to work properly the drm_gem_object_get() call in\n  drm_gem_ttm_mmap() must be moved so it happens before calling\n  obj->funcs->mmap(), otherwise the gem refcount would go down\n  to zero.\""}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"9786b65bc61acec63f923978c75e707afbb74bc7","status":"affected","lessThan":"4f8e469a2384dfa4047145b0093126462cbb6dc0","versionType":"git"},{"version":"9786b65bc61acec63f923978c75e707afbb74bc7","status":"affected","lessThan":"8244a3bc27b3efd057da154b8d7e414670d5044f","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_prime.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.5","versionType":"semver"},{"version":"5.15.5","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.16","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_prime.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0"},{"url":"https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access to a DRM render/primary node and userspace mmap of an exported dma-buf fd via ioctl/syscall paths, not remote packet processing.\nAC:L - The attacker fully controls the create/export/close/mmap sequence that leaves gem refcount at 1, so the UAF is triggered reliably with no race or victim-dependent state.\nPR:L - GEM create, PRIME export, and GEM close are available to unprivileged render clients (DRM_RENDER_ALLOW) on drivers such as amdgpu/nouveau; Android apps and desktop video/render-group users can open /dev/dri/renderD*.\nUI:N - The attacker performs all required DRM and mmap operations themselves; no action by another user is needed.\nS:U - Impact is confined to the local kernel/host security authority (standard local privilege escalation via DRM UAF), not a VM/IOMMU/sandbox boundary crossing.\nC:H - Use-after-free of a GEM/TTM object allows reclaim and reuse of the freed object, enabling arbitrary kernel memory disclosure primitives.\nI:H - The same UAF can be turned into heap corruption and write primitives for control-flow hijacking or arbitrary kernel writes.\nA:H - Dereferencing or refcounting the freed GEM object can oops/panic the kernel even without a full exploit chain."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:46:41.297Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.15.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.16"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-04-15T14:57:54.210831Z","id":"CVE-2021-47200","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-03T17:48:37.560Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T05:32:07.374Z"}}]}}}