CVE-2025-21816

In the Linux kernel, the following vulnerability has been resolved:

hrtimers: Force migrate away hrtimers queued after CPUHPAPHRTIMERS_DYING

hrtimers are migrated away from the dying CPU to any online target at the CPUHPAPHRTIMERS_DYING stage in order not to delay bandwidth timers handling tasks involved in the CPU hotplug forward progress.

However wakeups can still be performed by the outgoing CPU after CPUHPAPHRTIMERS_DYING. Those can result again in bandwidth timers being armed. Depending on several considerations (crystal ball power management based election, earliest timer already enqueued, timer migration enabled or not), the target may eventually be the current CPU even if offline. If that happens, the timer is eventually ignored.

The most notable example is RCU which had to deal with each and every of those wake-ups by deferring them to an online CPU, along with related workarounds:

_ e787644caf76 (rcu: Defer RCU kthreads wakeup when CPU is dying) _ 9139f93209d1 (rcu/nocb: Fix RT throttling hrtimer armed from offline CPU) _ f7345ccc62a4 (rcu/nocb: Fix rcuog wake-up from offline softirq)

The problem isn't confined to RCU though as the stop machine kthread (which runs CPUHPAPHRTIMERSDYING) reports its completion at the end of its work through cpustopsignaldone() and performs a wake up that eventually arms the deadline server timer:

WARNING: CPU: 94 PID: 588 at kernel/time/hrtimer.c:1086 hrtimerstartrangens+0x289/0x2d0 CPU: 94 UID: 0 PID: 588 Comm: migration/94 Not tainted Stopper: multicpustop+0x0/0x120 <- stopmachinecpuslocked+0x66/0xc0 RIP: 0010:hrtimerstartrangens+0x289/0x2d0 Call Trace: <TASK> startdltimer enqueuedlentity dlserverstart enqueuetaskfair enqueuetask ttwudoactivate trytowakeup complete cpustopperthread

Instead of providing yet another bandaid to work around the situation, fix it in the hrtimers infrastructure instead: always migrate away a timer to an online target whenever it is enqueued from an offline CPU.

This will also allow to revert all the above RCU disgraceful hacks.