5.5

CVE-2025-21816: hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING

Modified
AliasesUBUNTU-CVE-2025-21816DEBIAN-CVE-2025-21816
Published 27-02-2025Last modified 23-05-2026

Vulnerability summary

CVE-2025-21816 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.7% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.21%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 18 · Related 17
DLA-4328-1DSA-5973-1OPENSUSE-SU-2025:20091-1SUSE-SU-2025:21080-1SUSE-SU-2025:21147-1SUSE-SU-2025:21180-1

Timeline

  1. 27-02-2025
    PublishedVulnerability first disclosed.
  2. 23-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING hrtimers are migrated away from the dying CPU to any online target at the CPUHP_AP_HRTIMERS_DYING stage in order not to delay bandwidth timers handling tasks involved in the CPU hotplug forward progress. However wakeups can still be performed by the outgoing CPU after CPUHP_AP_HRTIMERS_DYING. Those can result again in bandwidth timers being armed. Depending on several considerations (crystal ball power management based election, earliest timer already enqueued, timer migration enabled or not), the target may eventually be the current CPU even if offline. If that happens, the timer is eventually ignored. The most notable example is RCU which had to deal with each and every of those wake-ups by deferring them to an online CPU, along with related workarounds: _ e787644caf76 (rcu: Defer RCU kthreads wakeup when CPU is dying) _ 9139f93209d1 (rcu/nocb: Fix RT throttling hrtimer armed from offline CPU) _ f7345ccc62a4 (rcu/nocb: Fix rcuog wake-up from offline softirq) The problem isn't confined to RCU though as the stop machine kthread (which runs CPUHP_AP_HRTIMERS_DYING) reports its completion at the end of its work through cpu_stop_signal_done() and performs a wake up that eventually arms the deadline server timer: WARNING: CPU: 94 PID: 588 at kernel/time/hrtimer.c:1086 hrtimer_start_range_ns+0x289/0x2d0 CPU: 94 UID: 0 PID: 588 Comm: migration/94 Not tainted Stopper: multi_cpu_stop+0x0/0x120 <- stop_machine_cpuslocked+0x66/0xc0 RIP: 0010:hrtimer_start_range_ns+0x289/0x2d0 Call Trace: <TASK> start_dl_timer enqueue_dl_entity dl_server_start enqueue_task_fair enqueue_task ttwu_do_activate try_to_wake_up complete cpu_stopper_thread Instead of providing yet another bandaid to work around the situation, fix it in the hrtimers infrastructure instead: always migrate away a timer to an online target whenever it is enqueued from an offline CPU. This will also allow to revert all the above RCU disgraceful hacks.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

11%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.21% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu133 products
  • linuxAll versions (No fix recorded) | < 6.8.0-64.67
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 6.8.0-1032.34
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 75b5016ce325f1ef9c63e5398a1064cf8a7a7354, < 82ac6adbbb2aad14548a71d5e2e37f4964a15e38 | ≥ 53f408cad05bb987af860af22f4151e5a18e6ee8, < 63815bef47ec25f5a125019ca480882481ee1553 | ≥ 5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94, < e456a88bddae4030ba962447bb84be6669f2a0c1 | ≥ 5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94, < 2aecec58e9040ce3d2694707889f9914a2374955 | ≥ 5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94, < 53dac345395c0d2493cbc2f4c85fe38aef5b63f5 | 9a2fc41acb69dd4e2a58d0c04346c3333c2341fc | 54d0d83a53508d687fd4a225f8aa1f18559562d0 | 7f4c89400d2997939f6971c7981cc780a219e36b | 6fcbcc6c8e52650749692c7613cbe71bf601670d | ≥ 6.1.68, < 6.1.141 | ≥ 6.6.7, < 6.6.93 | ≥ 4.19.302, < 4.20 | ≥ 5.4.264, < 5.5 | ≥ 5.10.204, < 5.11 | ≥ 5.15.143, < 5.16 | 6.7
  • linux_kernelEOL≥ 4.19.302, < 4.20 | ≥ 5.4.264, < 5.5 | ≥ 5.10.204, < 5.11 | ≥ 5.15.143, < 5.16 | ≥ 6.1.68, < 6.1.141 | ≥ 6.6.7, < 6.6.93 | ≥ 6.7.1, < 6.12.14 | ≥ 6.13, < 6.13.3 | 6.7 | 6.7:rc2 | 6.7:rc3 | 6.7:rc4 | 6.7:rc5 | 6.7:rc6 | 6.7:rc7 | 6.7:rc8 | 6.14:rc1
Debian1 product
  • linux< 6.1.147-1 | < 6.12.15-1

3 vendors · 136 products

References

22 links
Show all 22 references