CVE-2021-47327

iommu/arm-smmu: Fix arm_smmu_device refcount leak when arm_smmu_rpm_get fails

HIGH
7.1
CVSS Score
Published: May 21, 2024 at 02:35 PM UTC
Updated: June 17, 2026 at 04:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.1
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Fix arm_smmu_device refcount leak when arm_smmu_rpm_get fails arm_smmu_rpm_get() invokes pm_runtime_get_sync(), which increases the refcount of the "smmu" even though the return value is less than 0. The reference counting issue happens in some error handling paths of arm_smmu_rpm_get() in its caller functions. When arm_smmu_rpm_get() fails, the caller functions forget to decrease the refcount of "smmu" increased by arm_smmu_rpm_get(), causing a refcount leak. Fix this issue by calling pm_runtime_resume_and_get() instead of pm_runtime_get_sync() in arm_smmu_rpm_get(), which can keep the refcount balanced in case of failure.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v < 5.4.1345.0 ≤ v < 5.10.525.0 ≤ v < 5.12.195.0 ≤ v < 5.13.45.0 ≤ v < 5.145.0 ≤ v < 5.4.1345.11 ≤ v < 5.12.195.13 ≤ v < 5.13.45.5 ≤ v < 5.10.521da177e4c3f45.0d4a44f0750bb9bf7c44c22444a482756b2344a79
Vendor states this is fixed in 1adf30f198c2 (fixed)
Vendor states this is fixed in 1adf30f198c26539a62d761e45af72cde570413d (fixed)
Vendor states this is fixed in 3761ae0d0e54 (fixed)
Vendor states this is fixed in 3761ae0d0e549f2acdaf11f49df4ed06d256b20f (fixed)
Vendor states this is fixed in c4007596fbda (fixed)
Vendor states this is fixed in c4007596fbdabc29f858dc2e1990858a146b60b2 (fixed)
Vendor states this is fixed in fbf4daa6f410 (fixed)
Vendor states this is fixed in fbf4daa6f4105e01fbd3868006f65c163365c1e3 (fixed)
Vendor states this is fixed in fe92c0581990 (fixed)
Vendor states this is fixed in fe92c058199067ae90cf2a901ddf3c271893557a (fixed)
Vendor states this is fixed in 5.0 (unaffected)
Vendor states this is fixed in 5.10.52 (unaffected)
Vendor states this is fixed in 5.12.19 (unaffected)
Vendor states this is fixed in 5.13.4 (unaffected)
Vendor states this is fixed in 5.14 (unaffected)
Vendor states this is fixed in 5.4.134 (unaffected)

References (5)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/1adf30f198c26539a62d761e45af72cde570413d
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3761ae0d0e549f2acdaf11f49df4ed06d256b20f
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c4007596fbdabc29f858dc2e1990858a146b60b2
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/fbf4daa6f4105e01fbd3868006f65c163365c1e3
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/fe92c058199067ae90cf2a901ddf3c271893557a

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.1HIGHCISA-ADP
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-911

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card