CVE-2025-21816

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING

hrtimers are migrated away from the dying CPU to any online target at

the CPUHP_AP_HRTIMERS_DYING stage in order not to delay bandwidth timers

handling tasks involved in the CPU hotplug forward progress.

However wakeups can still be performed by the outgoing CPU after

CPUHP_AP_HRTIMERS_DYING. Those can result again in bandwidth timers being

armed. Depending on several considerations (crystal ball power management

based election, earliest timer already enqueued, timer migration enabled or

not), the target may eventually be the current CPU even if offline. If that

happens, the timer is eventually ignored.

The most notable example is RCU which had to deal with each and every of

those wake-ups by deferring them to an online CPU, along with related

workarounds:

_ e787644caf76 (rcu: Defer RCU kthreads wakeup when CPU is dying)

_ 9139f93209d1 (rcu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References