CVE-2021-47535 is a vulnerability identified in the Linux kernel, specifically within the Direct Rendering Manager (DRM) subsystem for Qualcomm Adreno 6xx series GPUs (a6xx). The issue arises from improper memory allocation in the function a6xx_get_gmu_registers(), which is responsible for reading GMU (Graphics Management Unit) registers. A recent commit (142639a52a01) intended to enhance the function to read three sets of registers failed to adjust the allocated memory size accordingly. This mismatch leads to a slab-out-of-bounds write detected by Kernel Address Sanitizer (KASAN), indicating a buffer overflow condition. The vulnerability is categorized under CWE-787 (Out-of-bounds Write). The impact is an out-of-bounds write in kernel space, which can cause a kernel crash (denial of service) or potentially be leveraged for privilege escalation or arbitrary code execution, although no direct evidence of exploitation in the wild exists. The CVSS v3.1 base score is 6.2 (medium severity), reflecting that the attack vector is local (AV:L), requires no privileges (PR:N), and no user interaction (UI:N), but impacts availability (A:H) without affecting confidentiality or integrity. The vulnerability affects Linux kernel versions containing the problematic commit, including backported versions such as chromeos-5.4. The flaw manifests during GPU crash state capture routines, which are triggered by kernel worker threads, potentially impacting devices using Qualcomm Adreno 6xx GPUs running affected Linux kernels. No official patches are linked in the provided data, but the issue is resolved in later kernel revisions by correcting the memory allocation size to match the number of registers read.

For European organizations, the primary impact of CVE-2021-47535 is the risk of denial of service on systems running affected Linux kernels with Qualcomm Adreno 6xx GPUs. This could disrupt operations on embedded devices, mobile platforms, or specialized hardware using these GPUs, particularly in sectors relying on Linux-based systems such as telecommunications, automotive, industrial control, and consumer electronics. While the vulnerability does not directly compromise confidentiality or integrity, the kernel crash could cause service interruptions, data loss, or system instability. In environments where uptime and reliability are critical, such as healthcare, manufacturing, or critical infrastructure, this could have significant operational consequences. The lack of known exploits in the wild reduces immediate risk, but the medium severity and local attack vector mean that attackers with local access (e.g., insiders or malware with limited privileges) could trigger the vulnerability. European organizations deploying Linux on devices with these GPUs should be aware of this risk, especially if devices are used in sensitive or high-availability contexts.

1. Update Linux kernels to versions where the vulnerability is patched, ensuring the memory allocation in a6xx_get_gmu_registers() matches the number of registers read. 2. For organizations unable to immediately update kernels, consider disabling or limiting GPU crash state capture features if feasible, to reduce the attack surface. 3. Implement strict access controls to limit local user access on affected systems, minimizing the risk of local exploitation. 4. Monitor system logs and kernel messages for KASAN warnings or unusual GPU crash reports that may indicate attempts to trigger the vulnerability. 5. Employ endpoint security solutions capable of detecting anomalous kernel behavior or local privilege escalation attempts. 6. Engage with hardware and Linux distribution vendors for timely patches and advisories specific to affected devices. 7. For embedded or specialized devices, coordinate with OEMs to ensure firmware and kernel updates are applied promptly. 8. Conduct internal audits to identify devices using Qualcomm Adreno 6xx GPUs running vulnerable kernels and prioritize remediation accordingly.