GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-47338 (GCVE-0-2021-47338)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:35 – Updated: 2026-08-05 08:47
VLAI
Title
fbmem: Do not delete the mode that is still in use
Summary
In the Linux kernel, the following vulnerability has been resolved: fbmem: Do not delete the mode that is still in use The execution of fb_delete_videomode() is not based on the result of the previous fbcon_mode_deleted(). As a result, the mode is directly deleted, regardless of whether it is still in use, which may cause UAF. ================================================================== BUG: KASAN: use-after-free in fb_mode_is_equal+0x36e/0x5e0 \ drivers/video/fbdev/core/modedb.c:924 Read of size 4 at addr ffff88807e0ddb1c by task syz-executor.0/18962 CPU: 2 PID: 18962 Comm: syz-executor.0 Not tainted 5.10.45-rc1+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ... Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x137/0x1be lib/dump_stack.c:118 print_address_description+0x6c/0x640 mm/kasan/report.c:385 __kasan_report mm/kasan/report.c:545 [inline] kasan_report+0x13d/0x1e0 mm/kasan/report.c:562 fb_mode_is_equal+0x36e/0x5e0 drivers/video/fbdev/core/modedb.c:924 fbcon_mode_deleted+0x16a/0x220 drivers/video/fbdev/core/fbcon.c:2746 fb_set_var+0x1e1/0xdb0 drivers/video/fbdev/core/fbmem.c:975 do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 18960: kasan_save_stack mm/kasan/common.c:48 [inline] kasan_set_track+0x3d/0x70 mm/kasan/common.c:56 kasan_set_free_info+0x17/0x30 mm/kasan/generic.c:355 __kasan_slab_free+0x108/0x140 mm/kasan/common.c:422 slab_free_hook mm/slub.c:1541 [inline] slab_free_freelist_hook+0xd6/0x1a0 mm/slub.c:1574 slab_free mm/slub.c:3139 [inline] kfree+0xca/0x3d0 mm/slub.c:4121 fb_delete_videomode+0x56a/0x820 drivers/video/fbdev/core/modedb.c:1104 fb_set_var+0x1f3/0xdb0 drivers/video/fbdev/core/fbmem.c:978 do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-12 15:00 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 13ff178ccd6d3b8074c542a911300b79c4eec255 , < 359311b85ebec7c07c3a08ae2f3def946cad33fa (git)
Affected: 13ff178ccd6d3b8074c542a911300b79c4eec255 , < 087bff9acd2ec6db3f61aceb3224bde90fe0f7f8 (git)
Affected: 13ff178ccd6d3b8074c542a911300b79c4eec255 , < f193509afc7ff37a46862610c93b896044d5b693 (git)
Affected: 13ff178ccd6d3b8074c542a911300b79c4eec255 , < d6e76469157d8f240e5dec6f8411aa8d306b1126 (git)
Affected: 13ff178ccd6d3b8074c542a911300b79c4eec255 , < 0af778269a522c988ef0b4188556aba97fb420cc (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 5.4.134 , ≤ 5.4.* (semver)
Unaffected: 5.10.52 , ≤ 5.10.* (semver)
Unaffected: 5.12.19 , ≤ 5.12.* (semver)
Unaffected: 5.13.4 , ≤ 5.13.* (semver)
Unaffected: 5.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47338",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T15:00:51.209603Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T15:01:02.502Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.605Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/359311b85ebec7c07c3a08ae2f3def946cad33fa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/087bff9acd2ec6db3f61aceb3224bde90fe0f7f8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f193509afc7ff37a46862610c93b896044d5b693"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d6e76469157d8f240e5dec6f8411aa8d306b1126"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0af778269a522c988ef0b4188556aba97fb420cc"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "359311b85ebec7c07c3a08ae2f3def946cad33fa",
              "status": "affected",
              "version": "13ff178ccd6d3b8074c542a911300b79c4eec255",
              "versionType": "git"
            },
            {
              "lessThan": "087bff9acd2ec6db3f61aceb3224bde90fe0f7f8",
              "status": "affected",
              "version": "13ff178ccd6d3b8074c542a911300b79c4eec255",
              "versionType": "git"
            },
            {
              "lessThan": "f193509afc7ff37a46862610c93b896044d5b693",
              "status": "affected",
              "version": "13ff178ccd6d3b8074c542a911300b79c4eec255",
              "versionType": "git"
            },
            {
              "lessThan": "d6e76469157d8f240e5dec6f8411aa8d306b1126",
              "status": "affected",
              "version": "13ff178ccd6d3b8074c542a911300b79c4eec255",
              "versionType": "git"
            },
            {
              "lessThan": "0af778269a522c988ef0b4188556aba97fb420cc",
              "status": "affected",
              "version": "13ff178ccd6d3b8074c542a911300b79c4eec255",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.13.*",
              "status": "unaffected",
              "version": "5.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.134",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.52",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.19",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13.4",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbmem: Do not delete the mode that is still in use\n\nThe execution of fb_delete_videomode() is not based on the result of the\nprevious fbcon_mode_deleted(). As a result, the mode is directly deleted,\nregardless of whether it is still in use, which may cause UAF.\n\n==================================================================\nBUG: KASAN: use-after-free in fb_mode_is_equal+0x36e/0x5e0 \\\ndrivers/video/fbdev/core/modedb.c:924\nRead of size 4 at addr ffff88807e0ddb1c by task syz-executor.0/18962\n\nCPU: 2 PID: 18962 Comm: syz-executor.0 Not tainted 5.10.45-rc1+ #3\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ...\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x137/0x1be lib/dump_stack.c:118\n print_address_description+0x6c/0x640 mm/kasan/report.c:385\n __kasan_report mm/kasan/report.c:545 [inline]\n kasan_report+0x13d/0x1e0 mm/kasan/report.c:562\n fb_mode_is_equal+0x36e/0x5e0 drivers/video/fbdev/core/modedb.c:924\n fbcon_mode_deleted+0x16a/0x220 drivers/video/fbdev/core/fbcon.c:2746\n fb_set_var+0x1e1/0xdb0 drivers/video/fbdev/core/fbmem.c:975\n do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nFreed by task 18960:\n kasan_save_stack mm/kasan/common.c:48 [inline]\n kasan_set_track+0x3d/0x70 mm/kasan/common.c:56\n kasan_set_free_info+0x17/0x30 mm/kasan/generic.c:355\n __kasan_slab_free+0x108/0x140 mm/kasan/common.c:422\n slab_free_hook mm/slub.c:1541 [inline]\n slab_free_freelist_hook+0xd6/0x1a0 mm/slub.c:1574\n slab_free mm/slub.c:3139 [inline]\n kfree+0xca/0x3d0 mm/slub.c:4121\n fb_delete_videomode+0x56a/0x820 drivers/video/fbdev/core/modedb.c:1104\n fb_set_var+0x1f3/0xdb0 drivers/video/fbdev/core/fbmem.c:978\n do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x44/0xa9"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered via local ioctl(FBIOPUT_VSCREENINFO) on /dev/fbN through do_fb_ioctl \u2192 fb_set_var; there is no network or adjacent-protocol path into fbmem/fbcon.\nAC:L - The attacker fully controls mode setup and FB_ACTIVATE_INV_MODE deletion; ignoring fbcon_mode_deleted()\u0027s in-use result deterministically frees a modelist entry while fb_display[].mode still points at it, with no attacker-independent race or layout requirement.\nPR:L - do_fb_ioctl/FBIOPUT_VSCREENINFO performs no capability check; access is only DAC on /dev/fbN, which seated users, video-group members, and embedded/Android graphics processes commonly have without init-namespace root.\nUI:N - The attacker opens the framebuffer device and issues the ioctl sequence directly; no separate victim action is required.\nS:U - Impact is kernel heap use-after-free and potential privilege escalation within the same host security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free of a groomable kmalloc fb_modelist object whose dangling mode pointer is later read (e.g. fb_mode_is_equal/display_to_var), enabling heap disclosure per UAF scoring guidance.\nI:H - UAF of a sprayable slab object allows reclaim/type confusion and corruption of kernel state through subsequent fbcon/fb_set_var paths, enabling write primitives and control-flow hijack.\nA:H - The syzkaller/KASAN report is a slab use-after-free that oopses in fb_mode_is_equal(); dereferencing the dangling pointer after reclaim or page return can panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:47:17.872Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/359311b85ebec7c07c3a08ae2f3def946cad33fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/087bff9acd2ec6db3f61aceb3224bde90fe0f7f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/f193509afc7ff37a46862610c93b896044d5b693"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6e76469157d8f240e5dec6f8411aa8d306b1126"
        },
        {
          "url": "https://git.kernel.org/stable/c/0af778269a522c988ef0b4188556aba97fb420cc"
        }
      ],
      "title": "fbmem: Do not delete the mode that is still in use",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47338",
    "datePublished": "2024-05-21T14:35:47.028Z",
    "dateReserved": "2024-05-21T14:28:16.978Z",
    "dateUpdated": "2026-08-05T08:47:17.872Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47338",
      "date": "2026-09-17",
      "epss": "0.00269",
      "percentile": "0.1923"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-47338\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T15:15:20.610\",\"lastModified\":\"2026-08-04T10:16:58.303\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfbmem: Do not delete the mode that is still in use\\n\\nThe execution of fb_delete_videomode() is not based on the result of the\\nprevious fbcon_mode_deleted(). As a result, the mode is directly deleted,\\nregardless of whether it is still in use, which may cause UAF.\\n\\n==================================================================\\nBUG: KASAN: use-after-free in fb_mode_is_equal+0x36e/0x5e0 \\\\\\ndrivers/video/fbdev/core/modedb.c:924\\nRead of size 4 at addr ffff88807e0ddb1c by task syz-executor.0/18962\\n\\nCPU: 2 PID: 18962 Comm: syz-executor.0 Not tainted 5.10.45-rc1+ #3\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ...\\nCall Trace:\\n __dump_stack lib/dump_stack.c:77 [inline]\\n dump_stack+0x137/0x1be lib/dump_stack.c:118\\n print_address_description+0x6c/0x640 mm/kasan/report.c:385\\n __kasan_report mm/kasan/report.c:545 [inline]\\n kasan_report+0x13d/0x1e0 mm/kasan/report.c:562\\n fb_mode_is_equal+0x36e/0x5e0 drivers/video/fbdev/core/modedb.c:924\\n fbcon_mode_deleted+0x16a/0x220 drivers/video/fbdev/core/fbcon.c:2746\\n fb_set_var+0x1e1/0xdb0 drivers/video/fbdev/core/fbmem.c:975\\n do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108\\n vfs_ioctl fs/ioctl.c:48 [inline]\\n __do_sys_ioctl fs/ioctl.c:753 [inline]\\n __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739\\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46\\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\\n\\nFreed by task 18960:\\n kasan_save_stack mm/kasan/common.c:48 [inline]\\n kasan_set_track+0x3d/0x70 mm/kasan/common.c:56\\n kasan_set_free_info+0x17/0x30 mm/kasan/generic.c:355\\n __kasan_slab_free+0x108/0x140 mm/kasan/common.c:422\\n slab_free_hook mm/slub.c:1541 [inline]\\n slab_free_freelist_hook+0xd6/0x1a0 mm/slub.c:1574\\n slab_free mm/slub.c:3139 [inline]\\n kfree+0xca/0x3d0 mm/slub.c:4121\\n fb_delete_videomode+0x56a/0x820 drivers/video/fbdev/core/modedb.c:1104\\n fb_set_var+0x1f3/0xdb0 drivers/video/fbdev/core/fbmem.c:978\\n do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108\\n vfs_ioctl fs/ioctl.c:48 [inline]\\n __do_sys_ioctl fs/ioctl.c:753 [inline]\\n __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739\\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46\\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: fbmem: No elimina el modo que a\u00fan est\u00e1 en uso. La ejecuci\u00f3n de fb_delete_videomode() no se basa en el resultado del fbcon_mode_deleted() anterior. Como resultado, el modo se elimina directamente, independientemente de si todav\u00eda est\u00e1 en uso, lo que puede causar UAF. ==================================================== ================ BUG: KASAN: use-after-free en fb_mode_is_equal+0x36e/0x5e0 \\\\ drivers/video/fbdev/core/modedb.c:924 Lectura de tama\u00f1o 4 en addr ffff88807e0ddb1c por tarea syz-executor.0/18962 CPU: 2 PID: 18962 Comm: syz-executor.0 No contaminado 5.10.45-rc1+ #3 Nombre de hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS .. Seguimiento de llamadas: __dump_stack lib/dump_stack.c:77 [en l\u00ednea] dump_stack+0x137/0x1be lib/dump_stack.c:118 print_address_description+0x6c/0x640 mm/kasan/report.c:385 __kasan_report mm/kasan/report.c: 545 [en l\u00ednea] kasan_report+0x13d/0x1e0 mm/kasan/report.c:562 fb_mode_is_equal+0x36e/0x5e0 drivers/video/fbdev/core/modedb.c:924 fbcon_mode_deleted+0x16a/0x220 drivers/video/fbdev/core/fbcon .c:2746 fb_set_var+0x1e1/0xdb0 drivers/video/fbdev/core/fbmem.c:975 do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108 vfs_ioctl fs/ioctl.c:48 [en l\u00ednea ] __do_sys_ioctl fs/ioctl.c:753 [en l\u00ednea] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 Entry_SYSCALL_64_after_hwframe+0x44/0xa9 Liberado por tarea 18960: kasan_save_stack mm/kasan/common.c:48 [en l\u00ednea] kasan_set_track+0x3d/0x70 mm/kasan/common.c:56 kasan_set_free_info+0x17/0x30 mm/kasan/generic.c:355 __kasan_slab_free+0x108/0x140 mm/kasan/ common.c:422 slab_free_hook mm/slub.c:1541 [en l\u00ednea] slab_free_freelist_hook+0xd6/0x1a0 mm/slub.c:1574 slab_free mm/slub.c:3139 [en l\u00ednea] kfree+0xca/0x3d0 mm/slub.c: 4121 fb_delete_videomode+0x56a/0x820 controladores/video/fbdev/core/modedb.c:1104 fb_set_var+0x1f3/0xdb0 controladores/video/fbdev/core/fbmem.c:978 do_fb_ioctl+0x4d9/0x6e0 controladores/video/fbdev/core/ fbmem.c:1108 vfs_ioctl fs/ioctl.c:48 [en l\u00ednea] __do_sys_ioctl fs/ioctl.c:753 [en l\u00ednea] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/ common.c:46 entrada_SYSCALL_64_after_hwframe+0x44/0xa9\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/video/fbdev/core/fbmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"13ff178ccd6d3b8074c542a911300b79c4eec255\",\"lessThan\":\"359311b85ebec7c07c3a08ae2f3def946cad33fa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13ff178ccd6d3b8074c542a911300b79c4eec255\",\"lessThan\":\"087bff9acd2ec6db3f61aceb3224bde90fe0f7f8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13ff178ccd6d3b8074c542a911300b79c4eec255\",\"lessThan\":\"f193509afc7ff37a46862610c93b896044d5b693\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13ff178ccd6d3b8074c542a911300b79c4eec255\",\"lessThan\":\"d6e76469157d8f240e5dec6f8411aa8d306b1126\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13ff178ccd6d3b8074c542a911300b79c4eec255\",\"lessThan\":\"0af778269a522c988ef0b4188556aba97fb420cc\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/video/fbdev/core/fbmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.134\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.52\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.12.19\",\"lessThanOrEqual\":\"5.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.13.4\",\"lessThanOrEqual\":\"5.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-12T15:00:51.209603Z\",\"id\":\"CVE-2021-47338\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.3\",\"versionEndExcluding\":\"5.4.134\",\"matchCriteriaId\":\"B6466E90-E229-4926-BEA7-9D888047B9C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.52\",\"matchCriteriaId\":\"7C1E6FB6-53C8-4DC4-8AE5-93094BA39F62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.12.19\",\"matchCriteriaId\":\"34C1A2F4-DD44-4CF1-8FD4-751A0D746A9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13\",\"versionEndExcluding\":\"5.13.4\",\"matchCriteriaId\":\"F93FA3CC-0C79-410B-A7D7-245C2AA0723A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"71268287-21A8-4488-AA4F-23C473153131\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/087bff9acd2ec6db3f61aceb3224bde90fe0f7f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0af778269a522c988ef0b4188556aba97fb420cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/359311b85ebec7c07c3a08ae2f3def946cad33fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d6e76469157d8f240e5dec6f8411aa8d306b1126\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f193509afc7ff37a46862610c93b896044d5b693\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/087bff9acd2ec6db3f61aceb3224bde90fe0f7f8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0af778269a522c988ef0b4188556aba97fb420cc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/359311b85ebec7c07c3a08ae2f3def946cad33fa\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d6e76469157d8f240e5dec6f8411aa8d306b1126\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f193509afc7ff37a46862610c93b896044d5b693\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:57:38+00:00",
      "cve": "CVE-2021-47338",
      "id": "CVE-2021-47338",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:fixed": "150",
      "product_status:known_not_affected": "150",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fbmem: Do not delete the mode that is still in use",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47338.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/359311b85ebec7c07c3a08ae2f3def946cad33fa\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/087bff9acd2ec6db3f61aceb3224bde90fe0f7f8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f193509afc7ff37a46862610c93b896044d5b693\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d6e76469157d8f240e5dec6f8411aa8d306b1126\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0af778269a522c988ef0b4188556aba97fb420cc\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T05:32:08.605Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-47338\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-12T15:00:51.209603Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-12T15:00:59.440Z\"}}], \"cna\": {\"title\": \"fbmem: Do not delete the mode that is still in use\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Triggered via local ioctl(FBIOPUT_VSCREENINFO) on /dev/fbN through do_fb_ioctl \\u2192 fb_set_var; there is no network or adjacent-protocol path into fbmem/fbcon.\\nAC:L - The attacker fully controls mode setup and FB_ACTIVATE_INV_MODE deletion; ignoring fbcon_mode_deleted()\u0027s in-use result deterministically frees a modelist entry while fb_display[].mode still points at it, with no attacker-independent race or layout requirement.\\nPR:L - do_fb_ioctl/FBIOPUT_VSCREENINFO performs no capability check; access is only DAC on /dev/fbN, which seated users, video-group members, and embedded/Android graphics processes commonly have without init-namespace root.\\nUI:N - The attacker opens the framebuffer device and issues the ioctl sequence directly; no separate victim action is required.\\nS:U - Impact is kernel heap use-after-free and potential privilege escalation within the same host security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - This is a use-after-free of a groomable kmalloc fb_modelist object whose dangling mode pointer is later read (e.g. fb_mode_is_equal/display_to_var), enabling heap disclosure per UAF scoring guidance.\\nI:H - UAF of a sprayable slab object allows reclaim/type confusion and corruption of kernel state through subsequent fbcon/fb_set_var paths, enabling write primitives and control-flow hijack.\\nA:H - The syzkaller/KASAN report is a slab use-after-free that oopses in fb_mode_is_equal(); dereferencing the dangling pointer after reclaim or page return can panic the kernel.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"13ff178ccd6d3b8074c542a911300b79c4eec255\", \"lessThan\": \"359311b85ebec7c07c3a08ae2f3def946cad33fa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"13ff178ccd6d3b8074c542a911300b79c4eec255\", \"lessThan\": \"087bff9acd2ec6db3f61aceb3224bde90fe0f7f8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"13ff178ccd6d3b8074c542a911300b79c4eec255\", \"lessThan\": \"f193509afc7ff37a46862610c93b896044d5b693\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"13ff178ccd6d3b8074c542a911300b79c4eec255\", \"lessThan\": \"d6e76469157d8f240e5dec6f8411aa8d306b1126\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"13ff178ccd6d3b8074c542a911300b79c4eec255\", \"lessThan\": \"0af778269a522c988ef0b4188556aba97fb420cc\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/video/fbdev/core/fbmem.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.134\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.52\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.12.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.12.*\"}, {\"status\": \"unaffected\", \"version\": \"5.13.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.13.*\"}, {\"status\": \"unaffected\", \"version\": \"5.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/video/fbdev/core/fbmem.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/359311b85ebec7c07c3a08ae2f3def946cad33fa\"}, {\"url\": \"https://git.kernel.org/stable/c/087bff9acd2ec6db3f61aceb3224bde90fe0f7f8\"}, {\"url\": \"https://git.kernel.org/stable/c/f193509afc7ff37a46862610c93b896044d5b693\"}, {\"url\": \"https://git.kernel.org/stable/c/d6e76469157d8f240e5dec6f8411aa8d306b1126\"}, {\"url\": \"https://git.kernel.org/stable/c/0af778269a522c988ef0b4188556aba97fb420cc\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfbmem: Do not delete the mode that is still in use\\n\\nThe execution of fb_delete_videomode() is not based on the result of the\\nprevious fbcon_mode_deleted(). As a result, the mode is directly deleted,\\nregardless of whether it is still in use, which may cause UAF.\\n\\n==================================================================\\nBUG: KASAN: use-after-free in fb_mode_is_equal+0x36e/0x5e0 \\\\\\ndrivers/video/fbdev/core/modedb.c:924\\nRead of size 4 at addr ffff88807e0ddb1c by task syz-executor.0/18962\\n\\nCPU: 2 PID: 18962 Comm: syz-executor.0 Not tainted 5.10.45-rc1+ #3\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ...\\nCall Trace:\\n __dump_stack lib/dump_stack.c:77 [inline]\\n dump_stack+0x137/0x1be lib/dump_stack.c:118\\n print_address_description+0x6c/0x640 mm/kasan/report.c:385\\n __kasan_report mm/kasan/report.c:545 [inline]\\n kasan_report+0x13d/0x1e0 mm/kasan/report.c:562\\n fb_mode_is_equal+0x36e/0x5e0 drivers/video/fbdev/core/modedb.c:924\\n fbcon_mode_deleted+0x16a/0x220 drivers/video/fbdev/core/fbcon.c:2746\\n fb_set_var+0x1e1/0xdb0 drivers/video/fbdev/core/fbmem.c:975\\n do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108\\n vfs_ioctl fs/ioctl.c:48 [inline]\\n __do_sys_ioctl fs/ioctl.c:753 [inline]\\n __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739\\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46\\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\\n\\nFreed by task 18960:\\n kasan_save_stack mm/kasan/common.c:48 [inline]\\n kasan_set_track+0x3d/0x70 mm/kasan/common.c:56\\n kasan_set_free_info+0x17/0x30 mm/kasan/generic.c:355\\n __kasan_slab_free+0x108/0x140 mm/kasan/common.c:422\\n slab_free_hook mm/slub.c:1541 [inline]\\n slab_free_freelist_hook+0xd6/0x1a0 mm/slub.c:1574\\n slab_free mm/slub.c:3139 [inline]\\n kfree+0xca/0x3d0 mm/slub.c:4121\\n fb_delete_videomode+0x56a/0x820 drivers/video/fbdev/core/modedb.c:1104\\n fb_set_var+0x1f3/0xdb0 drivers/video/fbdev/core/fbmem.c:978\\n do_fb_ioctl+0x4d9/0x6e0 drivers/video/fbdev/core/fbmem.c:1108\\n vfs_ioctl fs/ioctl.c:48 [inline]\\n __do_sys_ioctl fs/ioctl.c:753 [inline]\\n __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:739\\n do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46\\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.134\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.52\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.12.19\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.13.4\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.14\", \"versionStartIncluding\": \"5.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:47:17.872Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2021-47338\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:47:17.872Z\", \"dateReserved\": \"2024-05-21T14:28:16.978Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T14:35:47.028Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.