Linux Kernel up to 6.12.13/6.13.2/6.14-rc1 migration timer_migration.c off-by-one

Summaryinfo

A vulnerability has been found in Linux Kernel up to 6.12.13/6.13.2/6.14-rc1 and classified as problematic. This issue affects some unknown processing of the file kernel/time/timer_migration.c of the component migration. This manipulation causes off-by-one. This vulnerability is registered as CVE-2025-21813. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 6.12.13/6.13.2/6.14-rc1 and classified as problematic. Affected by this vulnerability is an unknown part of the file kernel/time/timer_migration.c of the component migration. The manipulation with an unknown input leads to a off-by-one vulnerability. The CWE definition for the vulnerability is CWE-193. A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: timers/migration: Fix off-by-one root mis-connection Before attaching a new root to the old root, the children counter of the new root is checked to verify that only the upcoming CPU's top group have been connected to it. However since the recently added commit b729cc1ec21a ("timers/migration: Fix another race between hotplug and idle entry/exit") this check is not valid anymore because the old root is pre-accounted as a child to the new root. Therefore after connecting the upcoming CPU's top group to the new root, the children count to be expected must be 2 and not 1 anymore. This omission results in the old root to not be connected to the new root. Then eventually the system may run with more than one top level, which defeats the purpose of a single idle migrator. Also the old root is pre-accounted but not connected upon the new root creation. But it can be connected to the new root later on. Therefore the old root may be accounted twice to the new root. The propagation of such overcommit can end up creating a double final top-level root with a groupmask incorrectly initialized. Although harmless given that the final top level roots will never have a parent to walk up to, this oddity opportunistically reported the core issue: WARNING: CPU: 8 PID: 0 at kernel/time/timer_migration.c:543 tmigr_requires_handle_remote CPU: 8 UID: 0 PID: 0 Comm: swapper/8 RIP: 0010:tmigr_requires_handle_remote Call Trace: <IRQ> ? tmigr_requires_handle_remote ? hrtimer_run_queues update_process_times tick_periodic tick_handle_periodic __sysvec_apic_timer_interrupt sysvec_apic_timer_interrupt </IRQ> Fix the problem by taking the old root into account in the children count of the new root so the connection is not omitted. Also warn when more than one top level group exists to better detect similar issues in the future.

It is possible to read the advisory at git.kernel.org. This vulnerability is known as CVE-2025-21813 since 12/29/2024. The exploitation appears to be difficult. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/17/2026).

The vulnerability scanner Nessus provides a plugin with the ID 235364 (Ubuntu 24.04 LTS : Linux kernel (OEM) vulnerabilities (USN-7491-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.12.14, 6.13.3 or 6.14-rc2 eliminates this vulnerability. Applying the patch c6dd70e5b465a2b77c7a7c3d868736d302e29aec/6f449d8fa1808a7f9ee644866bbc079285dbefdd/868c9037df626b3c245ee26a290a03ae1f9f58d3 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (235364) and CERT Bund (WID-SEC-2025-0461). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• Open Source Linux Kernel
• Dell Secure Connect Gateway

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.12.0
• 6.12.1
• 6.12.2
• 6.12.3
• 6.12.4
• 6.12.5
• 6.12.6
• 6.12.7
• 6.12.8
• 6.12.9
• 6.12.10
• 6.12.11
• 6.12.12
• 6.12.13
• 6.13.0
• 6.13.1
• 6.13.2
• 6.14-rc1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion