Memory Management Vulnerability in Linux Kernel: CVE-2025-21861
Summary
CVE-2025-21861: In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() If migration succeeded, we called folio_migrate_flags()->mem_cgroup_m... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It is known for its stability, performance, and security features. However, like any complex software, it is susceptible to vulnerabilities that can affect system integrity and performance. CVE-2025-21861 specifically addresses an issue in the memory management subsystem, particularly in the migration of memory pages, which can lead to improper handling of memory control groups (memcg).
Vulnerability Detail
CVE-2025-21861 is a vulnerability in the Linux kernel's memory management system, specifically in the migrate_device_finalize function. When migrating memory pages, if the migration succeeds, the old folio's memory control group data is set to zero. If the migration fails, the destination folio's memory control group data remains unset. This inconsistency can lead to the folio being incorrectly added to the least recently used (LRU) list, causing potential issues with memory management and leading to warnings in the system logs. The vulnerability can result in system instability and performance degradation, particularly when running memory-intensive applications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is advisable to monitor system logs for any warnings related to memory management and to apply the patch as soon as it is available.
Conclusion
CVE-2025-21861 is a significant vulnerability in the Linux kernel that affects memory management during page migration. It is crucial for users to update their systems to the patched versions to ensure stability and performance. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21861 is a vulnerability in the Linux kernel that affects memory management during the migration of memory pages.
This vulnerability can lead to improper handling of memory control groups, potentially causing system instability and performance issues.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
While no specific workarounds are available, it is important to monitor system logs for any related warnings and plan to update as soon as possible.
Detailed information can be found in the official CVE database and through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
