CVE-2021-47533

What it actually does

Use-after-free in drm/vc4 kms where the HVS FIFO commit pointer is not cleared after the wait completes, allowing the stale pointer to be copied into duplicated state and dereferenced after the drm_crtc_commit structure is freed.

Why it matters to the business

Local attackers on systems using vc4 graphics hardware may trigger kernel crashes or arbitrary code execution, potentially leading to denial of service or full system compromise on affected Linux deployments.

How an attack unfolds

An attacker with local access interacts with the DRM/KMS subsystem to perform a FIFO commit, waits for completion without clearing the pointer, then duplicates state so the dangling pointer is copied and later dereferenced after the original structure is freed.

How to fix it

Upgrade the Linux kernel to a version containing the fix that sets the HVS FIFO commit pointer to NULL after the wait completes.

How to confirm the fix worked

Confirm the presence of the NULL assignment after the wait in the vc4 kms commit path and verify the running kernel is newer than the vulnerable commit range.

Typical attack path

1. Obtain local user access on a vc4-equipped Linux system
2. Trigger a DRM commit that populates the HVS FIFO commit pointer
3. Allow the commit to complete without clearing the pointer
4. Duplicate the CRTC state to propagate the stale pointer
5. Force dereference of the freed structure to achieve use-after-free

How to detect it

Examine kernel logs for drm/vc4 related crashes or use-after-free warnings; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates for systems exposing vc4 DRM hardware
• Review graphics driver usage in production workloads for exposure
• Monitor kernel update channels for backported fixes