CVE-2021-47657: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47657 affects the Linux kernel's DRM (Direct Rendering Manager) Virtio GPU driver. The vulnerability was discovered when virtio_gpu_object_shmem_init() fails, causing virtio_gpu_array_put_free() to be called with objs equal to NULL, which could lead to a NULL pointer dereference. This issue was disclosed and patched in February 2025 (NVD).

The vulnerability exists in the virtio GPU driver's memory management code. Specifically, in the virtio_gpu_array_put_free() function, there was no check to ensure that the objs parameter was not NULL before attempting to access its members. This could occur when virtio_gpu_object_shmem_init() fails, for example due to fault injection as reported by syzbot (Kernel Commit).

If exploited, this vulnerability could lead to a NULL pointer dereference in the Linux kernel's DRM Virtio GPU driver, potentially causing a system crash or denial of service condition (NVD).

The vulnerability can be triggered when virtio_gpu_object_shmem_init() fails, which was demonstrated through fault injection testing by syzbot (Kernel Commit).

The issue has been fixed by adding a NULL pointer check in the virtio_gpu_array_put_free() function. The patch ensures that if objs is NULL, the function returns immediately before attempting to access any members (Kernel Commit).