CVE-2021-47610

What it actually does

Null pointer dereference in msm_ioctl_gem_submit() during kref_put leads to kernel panic and system crash on affected drm/msm devices.

Why it matters to the business

Unexpected full system crashes on Linux and Android devices disrupt operations, cause data loss, and require reboots with potential downtime for graphics workloads.

How an attack unfolds

An attacker with local access invokes a crafted DRM ioctl sequence against the msm driver that reaches msm_ioctl_gem_submit with a null object, triggering the dereference and panic; Android kernel RCE campaigns have targeted similar msm surfaces.

How to fix it

Upgrade to a Linux kernel containing the fix for this null-pointer path in drm/msm; apply the commit that resolves the dereference in msm_ioctl_gem_submit.

How to confirm the fix worked

Verify the running kernel contains the upstream fix; confirm absence of the vulnerable call path via source inspection or kernel version checks against the published resolution date.

Typical attack path

1. Obtain local unprivileged access on target device
2. Open DRM device node and prepare gem submit ioctl parameters
3. Trigger null object path in msm_ioctl_gem_submit via malformed request
4. Cause kref_put dereference and kernel panic

How to detect it

Review kernel logs for oops traces containing msm_ioctl_gem_submit and kref_put; correlate with unexpected reboots on Android or drm-enabled devices.

What your security team should do

• Prioritize kernel updates on all Android and Linux systems using msm DRM
• Monitor for kernel oops/panic logs referencing msm_ioctl_gem_submit
• Restrict unprivileged access to DRM device nodes where feasible