CVE-2021-47280

What it actually does

Race condition in drm_getunique() allows a use-after-free read of the file_priv->master pointer because the pointer is fetched before the device master mutex is acquired, permitting another thread to free the master structure via drm_new_set_master() while the first thread still holds a reference.

Why it matters to the business

Kernel memory corruption or information disclosure in graphics subsystems can cause system crashes, privilege escalation attempts, or data leaks on any Linux system using the DRM subsystem; the issue has been public for over two years with negligible exploitation likelihood.

How an attack unfolds

An attacker with local access triggers concurrent DRM master ioctl calls so that one thread reads file_priv->master after another thread has replaced and freed it under the mutex, resulting in a read of freed memory.

How to fix it

Apply the upstream fix that acquires the device master mutex before dereferencing file_priv->master; update to a kernel containing the resolution of this use-after-free.

How to confirm the fix worked

Confirm the presence of the mutex acquisition before the master pointer read in drm_getunique(); run the original syzbot reproducer and verify it no longer triggers a use-after-free report under KASAN or similar sanitizers.

Typical attack path

1. Obtain local unprivileged access to a Linux system exposing /dev/dri
2. Race drm_getunique() against drm_setmaster_ioctl() and drm_new_set_master() by issuing concurrent ioctls
3. Read freed master structure contents to leak kernel pointers or cause a crash

How to detect it

Search kernel logs for use-after-free reports referencing drm_getunique or drm_new_set_master; examine crash dumps containing references to freed master structures in the DRM subsystem.

What your security team should do

• Prioritize kernel updates on any systems exposing DRM devices to untrusted local users
• Monitor for future backports into distribution kernels given the two-year public disclosure window
• Restrict local access to graphics devices where feasible until patches are deployed