LiveActive security incident?Get immediate response
CVE Record

CVE-2021-47187: arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency The entry/exit latency and minimum residency in state for the idle states of MSM8998 were ..bad: first of all, for all of them the timings were written for CPU sleep but the min-residency-us param was miscalculated (supposedly, while porting this from downstream); Then, the power collapse states are setting PC on both the CPU cluster *and* the L2 cache, which have different timings: in the specific case of L2 the times are higher so these ones should be taken into account instead of the CPU ones. This parameter misconfiguration was not giving particular issues because on MSM8998 there was no CPU scaling at all, so cluster/L2 power collapse was rarely (if ever) hit. When CPU scaling is enabled, though, the wrong timings will produce SoC unstability shown to the user as random, apparently error-less, sudden reboots and/or lockups. This set of parameters are stabilizing the SoC when CPU scaling is ON and when power collapse is frequently hit.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-47187 is a Linux kernel device-tree timing bug for Qualcomm MSM8998 systems. Wrong CPU/L2 idle-state latency and residency values can make affected devices reboot or lock up unexpectedly when CPU scaling is enabled. The public sources do not indicate data theft, privilege escalation, or active exploitation.

Executive priority

Treat this as a targeted availability risk, not a broad compromise emergency. Patch affected MSM8998 Linux devices through normal maintenance, faster if they support critical operations or already show unexplained instability.

Technical view

The issue is in arm64 Qualcomm MSM8998 idle-state parameters. CPU sleep timings were used incorrectly, and L2 power-collapse timings were not accounted for. With CPU scaling enabled, frequent power-collapse transitions can destabilize the SoC, causing error-less reboots or lockups. Stable kernel commits correct the latency and minimum-residency values.

Likely exposure

Exposure appears limited to Linux kernels using the Qualcomm MSM8998 arm64 device tree, especially builds with CPU scaling enabled. Organizations should focus on embedded, mobile, or appliance fleets using MSM8998-based boards. The sources do not identify broader Linux platforms as affected.

Exploitation context

There is no KEV listing and no cited source reports active exploitation. The described failure mode is operational availability: random reboots or lockups under affected power-management behavior. Public evidence does not support remote exploitation or attacker-controlled compromise.

Researcher notes

The CVE record lacks CVSS, CWE, and exploit evidence. Analysis should stay tied to MSM8998 device-tree power-management behavior. Avoid generalizing to all Qualcomm or Linux systems without vendor confirmation.

Mitigation direction

  • Update to a kernel containing the referenced stable fixes.
  • Confirm downstream vendor kernels backported the MSM8998 idle-state corrections.
  • Check vendor guidance if no fixed package is available.
  • Prioritize devices showing sudden reboots or lockups after CPU scaling changes.

Validation and detection

  • Inventory systems for Qualcomm MSM8998 arm64 Linux kernels.
  • Check kernel source or package changelog for the referenced stable commits.
  • Verify CPU scaling is enabled on affected device builds.
  • Review device telemetry for unexplained reboots or lockups.
Prepared
Confidence
high
Sources
6

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-47187 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc3083c80b52c4e29b65ed838d2e66a91b13a3152, c3083c80b52c4e29b65ed838d2e66a91b13a3152, c3083c80b52c4e29b65ed838d2e66a91b13a3152, c3083c80b52c4e29b65ed838d2e66a91b13a3152unaffected
LinuxLinux5.3, 0, 5.4.162, 5.10.82, 5.15.5, 5.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.