CVE-2021-47187: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47187 affects the Linux kernel, specifically related to CPU/L2 idle state latency and residency in the MSM8998 SoC. The vulnerability was discovered and disclosed on April 10, 2024. The issue involves incorrect timing parameters for CPU sleep and power collapse states, particularly affecting systems with CPU scaling enabled (NVD).

The vulnerability stems from misconfigured timing parameters in the MSM8998 SoC's idle states. The timings were incorrectly written for CPU sleep, and the min-residency-us parameter was miscalculated. Additionally, the power collapse states affecting both CPU cluster and L2 cache had incorrect timing configurations, where L2 cache timings should have been prioritized due to their higher values (Kernel Commit).

When CPU scaling is enabled, the incorrect timing parameters can cause system instability manifesting as random, apparently error-less sudden reboots and/or lockups. This issue particularly affects systems where power collapse is frequently triggered (Kernel Commit).

The vulnerability was not particularly problematic when CPU scaling was disabled, as cluster/L2 power collapse was rarely triggered. However, when CPU scaling is enabled, the system becomes unstable due to the incorrect timing parameters (Kernel Commit).

The issue has been fixed by updating the timing parameters in the device tree source (DTS) file for MSM8998. The fix includes corrected values for entry-latency-us, exit-latency-us, and min-residency-us parameters for both little and big CPU cores in retention and power collapse states (Kernel Commit).