CVE-2021-47187: arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency
In the Linux kernel, the following vulnerability has been resolved:
arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency
The entry/exit latency and minimum residency in state for the idle
states of MSM8998 were ..bad: first of all, for all of them the
timings were written for CPU sleep but the min-residency-us param
was miscalculated (supposedly, while porting this from downstream);
Then, the power collapse states are setting PC on both the CPU
cluster *and* the L2 cache, which have different timings: in the
specific case of L2 the times are higher so these ones should be
taken into account instead of the CPU ones.
This parameter misconfiguration was not giving particular issues
because on MSM8998 there was no CPU scaling at all, so cluster/L2
power collapse was rarely (if ever) hit.
When CPU scaling is enabled, though, the wrong timings will produce
SoC unstability shown to the user as random, apparently error-less,
sudden reboots and/or lockups.
This set of parameters are stabilizing the SoC when CPU scaling is
ON and when power collapse is frequently hit.
Security readout for executives and security teams
Plain-English summary
CVE-2021-47187 is a Linux kernel device-tree timing bug for Qualcomm MSM8998 systems. Wrong CPU/L2 idle-state latency and residency values can make affected devices reboot or lock up unexpectedly when CPU scaling is enabled. The public sources do not indicate data theft, privilege escalation, or active exploitation.
Executive priority
Treat this as a targeted availability risk, not a broad compromise emergency. Patch affected MSM8998 Linux devices through normal maintenance, faster if they support critical operations or already show unexplained instability.
Technical view
The issue is in arm64 Qualcomm MSM8998 idle-state parameters. CPU sleep timings were used incorrectly, and L2 power-collapse timings were not accounted for. With CPU scaling enabled, frequent power-collapse transitions can destabilize the SoC, causing error-less reboots or lockups. Stable kernel commits correct the latency and minimum-residency values.
Likely exposure
Exposure appears limited to Linux kernels using the Qualcomm MSM8998 arm64 device tree, especially builds with CPU scaling enabled. Organizations should focus on embedded, mobile, or appliance fleets using MSM8998-based boards. The sources do not identify broader Linux platforms as affected.
Exploitation context
There is no KEV listing and no cited source reports active exploitation. The described failure mode is operational availability: random reboots or lockups under affected power-management behavior. Public evidence does not support remote exploitation or attacker-controlled compromise.
Researcher notes
The CVE record lacks CVSS, CWE, and exploit evidence. Analysis should stay tied to MSM8998 device-tree power-management behavior. Avoid generalizing to all Qualcomm or Linux systems without vendor confirmation.
Mitigation direction
Update to a kernel containing the referenced stable fixes.
Confirm downstream vendor kernels backported the MSM8998 idle-state corrections.
Check vendor guidance if no fixed package is available.
Prioritize devices showing sudden reboots or lockups after CPU scaling changes.
Validation and detection
Inventory systems for Qualcomm MSM8998 arm64 Linux kernels.
Check kernel source or package changelog for the referenced stable commits.
Verify CPU scaling is enabled on affected device builds.
Review device telemetry for unexplained reboots or lockups.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2021-47187 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.