CVE-2025-21861 – A use-after-free vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2025-21861?

CVE-2025-21861 has a CVSS score of 5.5 (MEDIUM). A use-after-free vulnerability in the Linux kernel's memory migration subsystem where folios (memory pages) with cleared memory cgroup data are incorrectly added to the LRU (Least Recently Used) list before being freed. This causes kernel warnings and potential memory corruption. Affects Linux systems using memory migration features like HMM (Heterogeneous Memory Management).

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's memory migration subsystem where folios (memory pages) with cleared memory cgroup data are incorrectly added to the LRU (Least Recently Used) list before being freed. This causes kernel warnings and potential memory corruption. Affects Linux systems using memory migration features like HMM (Heterogeneous Memory Management).

💻 Affected Systems

Products:

Linux Kernel

Versions: Specific versions between initial bug introduction and fix (exact range requires checking git commits, but appears to affect 6.13.x series)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires memory migration features to be used (like HMM device private migration). Not all systems may trigger this code path.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash due to memory corruption, potentially leading to denial of service or privilege escalation if combined with other vulnerabilities.

🟠

Likely Case

Kernel warning messages in logs and potential system instability during memory migration operations, but no direct exploitation path to privilege escalation.

🟢

If Mitigated

Minor performance impact from unnecessary LRU operations and kernel warnings in logs during memory migration tests.

🌐 Internet-Facing: LOW - This is a kernel-level memory management issue not directly exposed to network interfaces.

🏢 Internal Only: MEDIUM - Requires local access or ability to trigger memory migration operations, which could be exploited by malicious local users or through other vulnerabilities.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH - Requires specific conditions to trigger the memory migration code path and understanding of kernel memory management.

Primarily a reliability issue discovered through kernel selftests. No known exploitation in the wild.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 069dd21ea8262204f94737878389c2815a054a9e, 20fb6fc51863fbff7868de8b5f6d249d2094df1f, 3f9240d59e9a95d19f06120bfd1d0e681c6c0ac7, 41cddf83d8b00f29fd105e7a0777366edc69a5cf, 4f52f7c50f5b6f5eeb06823e21fe546d90f9c595

Vendor Advisory: https://git.kernel.org/stable/c/069dd21ea8262204f94737878389c2815a054a9e

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix commits. 2. Check your distribution's security advisories for backported patches. 3. Reboot the system after kernel update.

🔧 Temporary Workarounds

Disable HMM memory migration

linux

Prevent triggering of the vulnerable code path by disabling Heterogeneous Memory Management features if not required.

echo 0 > /sys/kernel/mm/hmm/migrate_device_enable
Add kernel boot parameter: hmm.migrate_device=0

🧯 If You Can't Patch

Restrict access to users who can run memory migration operations or HMM tests
Monitor kernel logs for warning messages related to folio_lruvec_lock_irqsave and investigate any occurrences

🔍 How to Verify

Check if Vulnerable:

Run the hmm selftest: # ./hmm-tests and check for kernel warnings about 'VM_WARN_ON_ONCE_FOLIO(!memcg && !mem_cgroup_disabled())'

Check Version:

uname -r

Verify Fix Applied:

Check kernel version includes the fix commits or run hmm-tests without generating the warning messages.

📡 Detection & Monitoring

Log Indicators:

Kernel warning: 'VM_WARN_ON_ONCE_FOLIO(!memcg && !mem_cgroup_disabled())'
Warnings from folio_lruvec_lock_irqsave function
Page dump messages during memory migration operations

Network Indicators:

None - this is a local memory management issue

SIEM Query:

source="kernel" AND "VM_WARN_ON_ONCE_FOLIO" OR "folio_lruvec_lock_irqsave"

📊 Metadata

CVE ID: CVE-2025-21861

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-416

EPSS Score: 0.06% exploit probability (19.5th percentile)

Published: March 12, 2025

Last Updated: October 2, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-21861, you might also want to check these: