Read the docs
TI-2025-15765 Aliases CVE-2025-21813GHSA-xjrx-58mf-555f

timers/migration: Fix off-by-one root mis-connection

Priority LOW 24CWE-193Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-193 and the CVSS impact.

Summary

In the Linux kernel, the following vulnerability has been resolved: timers/migration: Fix off-by-one root mis-connection Before attaching a new root to the old root, the children counter of the new root is checked to verify that only the upcoming CPU's top group have been connected to it. However since the recently added commit b729cc1ec21a ("timers/migration: Fix another race between hotplug and idle entry/exit") this check is not valid anymore because the old root is pre-accounted as a child to the new root. Therefore after connecting the upcoming CPU's top group to the new root, the children count to be expected must be 2 and not 1 anymore. This omission results in the old root to not be connected to the new root. Then eventually the system may run with more than one top level, which defeats the purpose of a single idle migrator. Also the old root is pre-accounted but not connected upon the new root creation. But it can be connected to the new root later on. Therefore the old root may be accounted twice to the new root. The propagation of such overcommit can end up creating a double final top-level root with a groupmask incorrectly initialized. Although harmless given that the final top level roots will never have a parent to walk up to, this oddity opportunistically reported the core issue: WARNING: CPU: 8 PID: 0 at kernel/time/timer_migration.c:543 tmigr_requires_handle_remote CPU: 8 UID: 0 PID: 0 Comm: swapper/8 RIP: 0010:tmigr_requires_handle_remote Call Trace: <IRQ> ? tmigr_requires_handle_remote ? hrtimer_run_queues update_process_times tick_periodic tick_handle_periodic __sysvec_apic_timer_interrupt sysvec_apic_timer_interrupt </IRQ> Fix the problem by taking the old root into account in the children count of the new root so the connection is not omitted. Also warn when more than one top level group exists to better detect similar issues in the future.

Why it matters now

EPSS 0.00191 8th percentileScored 2026-11-07
Fix Fixed Linux (Linux): 6.12.14, 6.13.3, 6.14

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux6.12.11 to before 6.12.146.12.14Patch availableCNA
LinuxLinux6.13 and later6.12.14, 6.13.3, 6.14Patch availableCNA
  • Linux VendorLinux Affected 6.12.11 to before 6.12.14 Fixed in 6.12.14 Patch available CNA
  • Linux VendorLinux Affected 6.13 and later Fixed in 6.12.14, 6.13.3, 6.14 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*6.12.11 to before 6.12.14; 6.13.1 to before 6.13.3VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*6.13VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*6.14 rc1VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 6.12.11 to before 6.12.14; 6.13.1 to before 6.13.3 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:* Versions 6.13 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:* Versions 6.14 rc1 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 6.12.14
  • Fix · CNA Linux (Linux) Fixed in 6.12.14, 6.13.3, 6.14

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 5 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-21813
  2. 2026-10-03 Alias added: GHSA-xjrx-58mf-555f

References

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources