---
id: CVE-2021-47659
title: 'drm/plane: Move range check for format_count earlier'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/plane: Move range check for format_count earlier

  While the check for format_count > 64 in __drm_universal_plane_init()
  shouldn't be hit (it's a WARN_ON), in its cu…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e6fc3b68558e4c6d8d160b5daf2511b99afa8814 <
    4ab7e453a3ee88c274cf97bee9487ab92a66d313
  - >-
    Linux >= e6fc3b68558e4c6d8d160b5daf2511b99afa8814 <
    1e29d829ad51d1472dd035487953a6724b56fc33
  - >-
    Linux >= e6fc3b68558e4c6d8d160b5daf2511b99afa8814 <
    b5cd108143513e4498027b96ec4710702d186f11
  - >-
    Linux >= e6fc3b68558e4c6d8d160b5daf2511b99afa8814 <
    978e3d023256bfaf34a0033d40c94e8a8e70cf3c
  - >-
    Linux >= e6fc3b68558e4c6d8d160b5daf2511b99afa8814 <
    787163d19bc3cdc6ca4b96223f62208534d1cf6b
  - >-
    Linux >= e6fc3b68558e4c6d8d160b5daf2511b99afa8814 <
    ad6dd7a2bac86118985c7b3426e175b9d3c1ec4f
  - >-
    Linux >= e6fc3b68558e4c6d8d160b5daf2511b99afa8814 <
    4b674dd69701c2e22e8e7770c1706a69f3b17269
  - Linux 4.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:42:32.788551Z'
published: '2025-02-26'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:49:35.497Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2021-47659'
references:
  - url: 'https://git.kernel.org/stable/c/4ab7e453a3ee88c274cf97bee9487ab92a66d313'
  - url: 'https://git.kernel.org/stable/c/1e29d829ad51d1472dd035487953a6724b56fc33'
  - url: 'https://git.kernel.org/stable/c/b5cd108143513e4498027b96ec4710702d186f11'
  - url: 'https://git.kernel.org/stable/c/978e3d023256bfaf34a0033d40c94e8a8e70cf3c'
  - url: 'https://git.kernel.org/stable/c/787163d19bc3cdc6ca4b96223f62208534d1cf6b'
  - url: 'https://git.kernel.org/stable/c/ad6dd7a2bac86118985c7b3426e175b9d3c1ec4f'
  - url: 'https://git.kernel.org/stable/c/4b674dd69701c2e22e8e7770c1706a69f3b17269'
tags:
  - cve.org
epss: 0.00267
epssPercentile: 0.18982
ingestedAt: '2026-11-05T22:38:31.561Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/plane: Move range check for format_count earlier

While the check for format_count > 64 in __drm_universal_plane_init()
shouldn't be hit (it's a WARN_ON), in its current position it will then
leak the plane->format_types array and fail to call
drm_mode_object_unregister() leaking the modeset identifier. Move it to
the start of the function to avoid allocating those resources in the
first place.

## Affected

- `Linux >= e6fc3b68558e4c6d8d160b5daf2511b99afa8814 < 4ab7e453a3ee88c274cf97bee9487ab92a66d313`
- `Linux >= e6fc3b68558e4c6d8d160b5daf2511b99afa8814 < 1e29d829ad51d1472dd035487953a6724b56fc33`
- `Linux >= e6fc3b68558e4c6d8d160b5daf2511b99afa8814 < b5cd108143513e4498027b96ec4710702d186f11`
- `Linux >= e6fc3b68558e4c6d8d160b5daf2511b99afa8814 < 978e3d023256bfaf34a0033d40c94e8a8e70cf3c`
- `Linux >= e6fc3b68558e4c6d8d160b5daf2511b99afa8814 < 787163d19bc3cdc6ca4b96223f62208534d1cf6b`
- `Linux >= e6fc3b68558e4c6d8d160b5daf2511b99afa8814 < ad6dd7a2bac86118985c7b3426e175b9d3c1ec4f`
- `Linux >= e6fc3b68558e4c6d8d160b5daf2511b99afa8814 < 4b674dd69701c2e22e8e7770c1706a69f3b17269`
- `Linux 4.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.