CVE-2021-47657: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47657 affects the Linux kernel's DRM (Direct Rendering Manager) Virtio GPU driver. The vulnerability was discovered when virtiogpuobjectshmeminit() fails, causing virtiogpuarrayputfree() to be called with objs equal to NULL, which could lead to a NULL pointer dereference. This issue was disclosed and patched in February 2025 (NVD).

The vulnerability exists in the virtio GPU driver's memory management code. Specifically, in the virtiogpuarrayputfree() function, there was no check to ensure that the objs parameter was not NULL before attempting to access its members. This could occur when virtiogpuobjectshmeminit() fails, for example due to fault injection as reported by syzbot (Kernel Commit).

If exploited, this vulnerability could lead to a NULL pointer dereference in the Linux kernel's DRM Virtio GPU driver, potentially causing a system crash or denial of service condition (NVD).

The issue has been fixed by adding a NULL pointer check in the virtiogpuarrayputfree() function. The patch ensures that if objs is NULL, the function returns immediately before attempting to access any members (Kernel Commit).