{"id":"CVE-2021-47659","state":"PUBLISHED","title":"drm/plane: Move range check for format_count earlier","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/plane: Move range check for format_count earlier\n\nWhile the check for format_count > 64 in __drm_universal_plane_init()\nshouldn't be hit (it's a WARN_ON), in its current position it will then\nleak the plane->format_types array and fail to call\ndrm_mode_object_unregister() leaking the modeset identifier. Move it to\nthe start of the function to avoid allocating those resources in the\nfirst place.","publishedAt":"2025-02-26T02:05:56.954Z","updatedAt":"2026-05-11T13:58:47.008Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e6fc3b68558e4c6d8d160b5daf2511b99afa8814","status":"affected","lessThan":"4ab7e453a3ee88c274cf97bee9487ab92a66d313","versionType":"git"},{"version":"e6fc3b68558e4c6d8d160b5daf2511b99afa8814","status":"affected","lessThan":"1e29d829ad51d1472dd035487953a6724b56fc33","versionType":"git"},{"version":"e6fc3b68558e4c6d8d160b5daf2511b99afa8814","status":"affected","lessThan":"b5cd108143513e4498027b96ec4710702d186f11","versionType":"git"},{"version":"e6fc3b68558e4c6d8d160b5daf2511b99afa8814","status":"affected","lessThan":"978e3d023256bfaf34a0033d40c94e8a8e70cf3c","versionType":"git"},{"version":"e6fc3b68558e4c6d8d160b5daf2511b99afa8814","status":"affected","lessThan":"787163d19bc3cdc6ca4b96223f62208534d1cf6b","versionType":"git"},{"version":"e6fc3b68558e4c6d8d160b5daf2511b99afa8814","status":"affected","lessThan":"ad6dd7a2bac86118985c7b3426e175b9d3c1ec4f","versionType":"git"},{"version":"e6fc3b68558e4c6d8d160b5daf2511b99afa8814","status":"affected","lessThan":"4b674dd69701c2e22e8e7770c1706a69f3b17269","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_plane.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.14","versionType":"semver"},{"version":"4.19.247","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.198","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.121","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.46","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.17.14","status":"unaffected","lessThanOrEqual":"5.17.*","versionType":"semver"},{"version":"5.18.3","status":"unaffected","lessThanOrEqual":"5.18.*","versionType":"semver"},{"version":"5.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_plane.c"]}],"references":["https://git.kernel.org/stable/c/4ab7e453a3ee88c274cf97bee9487ab92a66d313","https://git.kernel.org/stable/c/1e29d829ad51d1472dd035487953a6724b56fc33","https://git.kernel.org/stable/c/b5cd108143513e4498027b96ec4710702d186f11","https://git.kernel.org/stable/c/978e3d023256bfaf34a0033d40c94e8a8e70cf3c","https://git.kernel.org/stable/c/787163d19bc3cdc6ca4b96223f62208534d1cf6b","https://git.kernel.org/stable/c/ad6dd7a2bac86118985c7b3426e175b9d3c1ec4f","https://git.kernel.org/stable/c/4b674dd69701c2e22e8e7770c1706a69f3b17269"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47659.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47659","state":"PUBLISHED","datePublished":"2025-02-26T02:05:56.954Z","dateUpdated":"2026-05-11T13:58:47.008Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-02-26T02:04:38.057Z"},"containers":{"cna":{"title":"drm/plane: Move range check for format_count earlier","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/plane: Move range check for format_count earlier\n\nWhile the check for format_count > 64 in __drm_universal_plane_init()\nshouldn't be hit (it's a WARN_ON), in its current position it will then\nleak the plane->format_types array and fail to call\ndrm_mode_object_unregister() leaking the modeset identifier. Move it to\nthe start of the function to avoid allocating those resources in the\nfirst place."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e6fc3b68558e4c6d8d160b5daf2511b99afa8814","status":"affected","lessThan":"4ab7e453a3ee88c274cf97bee9487ab92a66d313","versionType":"git"},{"version":"e6fc3b68558e4c6d8d160b5daf2511b99afa8814","status":"affected","lessThan":"1e29d829ad51d1472dd035487953a6724b56fc33","versionType":"git"},{"version":"e6fc3b68558e4c6d8d160b5daf2511b99afa8814","status":"affected","lessThan":"b5cd108143513e4498027b96ec4710702d186f11","versionType":"git"},{"version":"e6fc3b68558e4c6d8d160b5daf2511b99afa8814","status":"affected","lessThan":"978e3d023256bfaf34a0033d40c94e8a8e70cf3c","versionType":"git"},{"version":"e6fc3b68558e4c6d8d160b5daf2511b99afa8814","status":"affected","lessThan":"787163d19bc3cdc6ca4b96223f62208534d1cf6b","versionType":"git"},{"version":"e6fc3b68558e4c6d8d160b5daf2511b99afa8814","status":"affected","lessThan":"ad6dd7a2bac86118985c7b3426e175b9d3c1ec4f","versionType":"git"},{"version":"e6fc3b68558e4c6d8d160b5daf2511b99afa8814","status":"affected","lessThan":"4b674dd69701c2e22e8e7770c1706a69f3b17269","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_plane.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.14","versionType":"semver"},{"version":"4.19.247","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.198","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.121","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.46","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.17.14","status":"unaffected","lessThanOrEqual":"5.17.*","versionType":"semver"},{"version":"5.18.3","status":"unaffected","lessThanOrEqual":"5.18.*","versionType":"semver"},{"version":"5.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_plane.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/4ab7e453a3ee88c274cf97bee9487ab92a66d313"},{"url":"https://git.kernel.org/stable/c/1e29d829ad51d1472dd035487953a6724b56fc33"},{"url":"https://git.kernel.org/stable/c/b5cd108143513e4498027b96ec4710702d186f11"},{"url":"https://git.kernel.org/stable/c/978e3d023256bfaf34a0033d40c94e8a8e70cf3c"},{"url":"https://git.kernel.org/stable/c/787163d19bc3cdc6ca4b96223f62208534d1cf6b"},{"url":"https://git.kernel.org/stable/c/ad6dd7a2bac86118985c7b3426e175b9d3c1ec4f"},{"url":"https://git.kernel.org/stable/c/4b674dd69701c2e22e8e7770c1706a69f3b17269"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T13:58:47.008Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"4.19.247"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.4.198"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.10.121"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.15.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.17.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.18.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.19"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}