https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 11:10:21 +0000 https://cve.radiocsirt.org/vuln/cve-2021-47200 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap</p> <p>drm_gem_ttm_mmap() drops a reference to the gem object on success. If the gem object&#39;s refcount == 1 on entry to drm_gem_prime_mmap(), that drop will free the gem object, and the subsequent drm_gem_object_get() will be a UAF. Fix by grabbing a reference before calling the mmap helper.</p> <p>This issue was forseen when the reference dropping was adding in commit 9786b65bc61ac (&#34;drm/ttm: fix mmap refcounting&#34;): &#34;For that to work properly the drm_gem_object_get() call in drm_gem_ttm_mmap() must be moved so it happens before calling obj-&gt;funcs-&gt;mmap(), otherwise the gem refcount would go down to zero.&#34;</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap</p> <p>drm_gem_ttm_mmap() drops a reference to the gem object on success. If the gem object&#39;s refcount == 1 on entry to drm_gem_prime_mmap(), that drop will free the gem object, and the subsequent drm_gem_object_get() will be a UAF. Fix by grabbing a reference before calling the mmap helper.</p> <p>This issue was forseen when the reference dropping was adding in commit 9786b65bc61ac (&#34;drm/ttm: fix mmap refcounting&#34;): &#34;For that to work properly the drm_gem_object_get() call in drm_gem_ttm_mmap() must be moved so it happens before calling obj-&gt;funcs-&gt;mmap(), otherwise the gem refcount would go down to zero.&#34;</p> https://cve.radiocsirt.org/vuln/cve-2021-47200