The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING hrtimers are migrated away from     the dying CPU to any online target at the CPUHP_AP_HRTIMERS_DYING stage in order not to delay bandwidth     timers handling tasks involved in the CPU hotplug forward progress. However wakeups can still be performed     by the outgoing CPU after CPUHP_AP_HRTIMERS_DYING. Those can result again in bandwidth timers being armed.
    Depending on several considerations (crystal ball power management based election, earliest timer already     enqueued, timer migration enabled or not), the target may eventually be the current CPU even if offline.
    If that happens, the timer is eventually ignored. The most notable example is RCU which had to deal with     each and every of those wake-ups by deferring them to an online CPU, along with related workarounds: _     e787644caf76 (rcu: Defer RCU kthreads wakeup when CPU is dying) _ 9139f93209d1 (rcu/nocb: Fix RT     throttling hrtimer armed from offline CPU) _ f7345ccc62a4 (rcu/nocb: Fix rcuog wake-up from offline     softirq) The problem isn't confined to RCU though as the stop machine kthread (which runs     CPUHP_AP_HRTIMERS_DYING) reports its completion at the end of its work through cpu_stop_signal_done() and     performs a wake up that eventually arms the deadline server timer: WARNING: CPU: 94 PID: 588 at     kernel/time/hrtimer.c:1086 hrtimer_start_range_ns+0x289/0x2d0 CPU: 94 UID: 0 PID: 588 Comm: migration/94     Not tainted Stopper: multi_cpu_stop+0x0/0x120 <- stop_machine_cpuslocked+0x66/0xc0 RIP:
    0010:hrtimer_start_range_ns+0x289/0x2d0 Call Trace: <TASK> start_dl_timer enqueue_dl_entity     dl_server_start enqueue_task_fair enqueue_task ttwu_do_activate try_to_wake_up complete cpu_stopper_thread     Instead of providing yet another bandaid to work around the situation, fix it in the hrtimers     infrastructure instead: always migrate away a timer to an online target whenever it is enqueued from an     offline CPU. This will also allow to revert all the above RCU disgraceful hacks. (CVE-2025-21816)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-21816

medium Nessus Plugin ID 231503

Version 1.13

Version 1.12

Version 1.11

Version 1.10

Version 1.9

Version 1.8

Version 1.4

Version 1.3

Version 1.1

Version 1.13 Jan 15, 2026, 2:04 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601151404
Version 1.12 Jan 10, 2026, 7:58 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601101958
Version 1.11 Dec 4, 2025, 7:43 PM Detection (updated detection logic) Plugin Feed: 202512041943
Version 1.10 Nov 24, 2025, 10:08 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202511242208
Version 1.9 Oct 29, 2025, 3:03 AM Detection (updated detection logic) Plugin Feed: 202510290303
Version 1.8 Oct 28, 2025, 9:02 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") Detection (updated detection logic) Plugin Feed: 202510280902
Version 1.4 Sep 4, 2025, 5:30 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202509041730
Version 1.3 Aug 31, 2025, 7:32 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202508311932
Version 1.1 Mar 6, 2025, 5:02 PM New Plugin Feed: 202503061702