Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory safety bug in the Qualcomm Adreno A6xx graphics driver path. During GPU crash-state capture, the kernel allocated too little space for GMU register data, causing an out-of-bounds write. The main business risk is device instability or denial of service on affected systems, not data theft based on the provided sources.
Executive priority
Handle through normal kernel patch management, with higher priority for fleets using Qualcomm Adreno A6xx devices. This is not shown as actively exploited, but it can affect availability and should not remain in long-lived device images.
Technical view
The issue is a CWE-787 slab out-of-bounds write in drm/msm/a6xx register capture. A prior change made a6xx_get_gmu_registers() read three register sets, but the allocation size was not increased. KASAN reported an 8-byte write beyond the allocated array during msm_gpu_crashstate_capture() in the GPU recovery worker.
Likely exposure
Exposure appears limited to Linux systems running affected kernel builds with the msm A6xx GPU driver path, including affected stable branches or backports carrying the problematic commit. The source explicitly mentions a chromeos-5.4 kernel with the commit backported. General Linux servers without this graphics stack are less likely to be exposed.
Exploitation context
The CVSS vector is local, low complexity, no privileges, no user interaction, with high availability impact. The provided bundle does not show KEV listing or active exploitation. Treat this as a stability and denial-of-service concern unless vendor guidance or telemetry shows broader impact.
Researcher notes
Evidence is strongest for the exact crash-state capture allocation mismatch described in the kernel fix. The source bundle does not provide exploit details, affected device models beyond the KASAN example, or distribution-specific fixed package versions. Validate downstream exposure by commit presence and driver usage.
Mitigation direction
- Apply vendor kernel updates that include the referenced stable fixes.
- Prioritize affected laptops, tablets, embedded devices, or ChromeOS-derived builds using Adreno A6xx graphics.
- Check downstream kernel backports, not only upstream version numbers.
- Follow Linux distribution or device vendor advisories for exact fixed builds.
- Avoid unsupported kernel trees carrying the problematic commit without the allocation fix.
Validation and detection
- Inventory devices using the Linux msm DRM A6xx driver path.
- Compare deployed kernel versions and backported commits with vendor fixed builds.
- Confirm the referenced stable fix commits are present in maintained kernel branches.
- Review kernel crash logs for KASAN slab-out-of-bounds reports in a6xx_get_gmu_registers().
- Regression-test GPU recovery and crash-state capture after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-47535 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H2.53.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.2MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d646856a600e8635ba498f20b194219b158626e8CVE reference, Linux
- https://git.kernel.org/stable/c/83e54fcf0b14ca2d869dd37abe1bb6542805f538CVE reference, Linux
- https://git.kernel.org/stable/c/b4d25abf9720b69a03465b09d0d62d1998ed6708CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.