Security tracker / CVE-2025-21816

CVE-2025-21816

hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING

References

• Debian security tracker
• cve.org

Notes

 carnil> Introduced in 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing
 carnil> CPU earlier"). Vulnerable versions: 4.19.302 5.4.264 5.10.204 5.15.143 6.1.68
 carnil> 6.6.7 6.7-rc2.

Bugs

Status

Branch	Status
upstream	released (6.14-rc2) [53dac345395c0d2493cbc2f4c85fe38aef5b63f5]
6.18-upstream-stable	N/A "Fixed before branching point"
6.17-upstream-stable	N/A "Fixed before branching point"
6.13-upstream-stable	released (6.13.3) [2aecec58e9040ce3d2694707889f9914a2374955]
6.12-upstream-stable	released (6.12.14) [e456a88bddae4030ba962447bb84be6669f2a0c1]
6.6-upstream-stable	released (6.6.93) [63815bef47ec25f5a125019ca480882481ee1553]
6.1-upstream-stable	released (6.1.141) [82ac6adbbb2aad14548a71d5e2e37f4964a15e38]
5.10-upstream-stable	needed
sid	released (6.12.15-1)
6.12-trixie-security	N/A "Fixed before branching point"
6.1-bookworm-security	released (6.1.147-1)
5.10-bullseye-security	needed