Detections
Analytics

Echo: linux: security update to 6.1.147-1

medium Tenable Self-Hosted Container Security Plugin ID 462764

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: hrtimers: Force migrate away hrtimers
 queued after CPUHP_AP_HRTIMERS_DYING hrtimers are migrated away from the dying CPU to any online target at
 the CPUHP_AP_HRTIMERS_DYING stage in order not to delay bandwidth timers handling tasks involved in the
 CPU hotplug forward progress. However wakeups can still be performed by the outgoing CPU after
 CPUHP_AP_HRTIMERS_DYING. Those can result again in bandwidth timers being armed. Depending on several
 considerations (crystal ball power management based election, earliest timer already enqueued, timer
 migration enabled or not), the target may eventually be the current CPU even if offline. If that happens,
 the timer is eventually ignored. The most notable example is RCU which had to deal with each and every of
 those wake-ups by deferring them to an online CPU, along with related workarounds: _ e787644caf76 (rcu:
 Defer RCU kthreads wakeup when CPU is dying) _ 9139f93209d1 (rcu/nocb: Fix RT throttling hrtimer armed
 from offline CPU) _ f7345ccc62a4 (rcu/nocb: Fix rcuog wake-up from offline softirq) The problem isn't
 confined to RCU though as the stop machine kthread (which runs CPUHP_AP_HRTIMERS_DYING) reports its
 completion at the end of its work through cpu_stop_signal_done() and performs a wake up that eventually
 arms the deadline server timer: WARNING: CPU: 94 PID: 588 at kernel/time/hrtimer.c:1086
 hrtimer_start_range_ns+0x289/0x2d0 CPU: 94 UID: 0 PID: 588 Comm: migration/94 Not tainted Stopper:
 multi_cpu_stop+0x0/0x120 <- stop_machine_cpuslocked+0x66/0xc0 RIP: 0010:hrtimer_start_range_ns+0x289/0x2d0
 Call Trace: <TASK> start_dl_timer enqueue_dl_entity dl_server_start enqueue_task_fair enqueue_task
 ttwu_do_activate try_to_wake_up complete cpu_stopper_thread Instead of providing yet another bandaid to
 work around the situation, fix it in the hrtimers infrastructure instead: always migrate away a timer to
 an online target whenever it is enqueued from an offline CPU. This will also allow to revert all the above
 RCU disgraceful hacks. (CVE-2025-21816)

Solution

Update the linux library and its related packages to version 6.1.147-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-21816

Plugin Details

Severity: Medium

ID: 462764

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-21816

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 2/27/2025

Reference Information

CVE: CVE-2025-21816