CVE-2021-47051

What it actually does

A power management runtime reference leak occurs in the lpspi_prepare_xfer_hardware function when pm_runtime_get_sync fails after incrementing the usage counter without a matching put operation.

Why it matters to the business

Long-term resource accounting imbalance in power management on affected Linux systems may contribute to gradual instability or unexpected power behavior in embedded environments, though impact remains low given minimal exploitation likelihood.

How an attack unfolds

An attacker requires local access to repeatedly invoke SPI transfer preparation paths that force pm_runtime_get_sync failures, slowly exhausting runtime references; no remote or practical exploitation vectors are known and EPSS remains negligible with no threat actor activity recorded.

How to fix it

Replace calls to pm_runtime_get_sync with pm_runtime_resume_and_get in the fsl-lpspi driver source and rebuild the kernel; apply any subsequent upstream Linux kernel updates that contain this correction.

How to confirm the fix worked

Inspect drivers/spi/fsl-lpspi.c for the corrected pm_runtime_resume_and_get usage and verify the change is present in the running kernel build.

Typical attack path

1. Obtain local execution context on a system using the fsl-lpspi driver
2. Trigger repeated SPI hardware preparation calls that cause pm_runtime_get_sync to fail
3. Accumulate unreleased runtime references over extended operation

How to detect it

Examine kernel logs and dmesg output for repeated pm_runtime failure messages originating from the SPI LPSPI driver; correlate with process activity that exercises SPI transfers over long periods.

What your security team should do

• Prioritize kernel updates on systems using Freescale LPSPI hardware
• Review power management logs for anomalies after patching
• Track EPSS and KEV status for any future changes indicating increased risk