Memory Corruption Vulnerability in Linux Kernel - CVE-2025-21919
Summary
CVE-2025-21919: In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list child_cfs_rq_on_list attempts to convert a 'prev' pointer to a cfs_rq. Affects linux versions < 6.1.133-1. Fixed in 6.1.133-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware resources and providing essential services for software applications. It is known for its stability, performance, and extensive support for various hardware architectures. However, vulnerabilities can arise due to complex interactions within its code, such as the one identified in CVE-2025-21919, which poses a risk of memory corruption.
Vulnerability Detail
CVE-2025-21919 is a vulnerability in the Linux kernel that arises from an improper conversion of a 'prev' pointer to a cfs_rq structure within the child_cfs_rq_on_list function. This pointer can originate from the struct rq's leaf_cfs_rq_list, leading to potential memory corruption. If exploited, this could result in memory faults or access to garbage data, causing unpredictable behavior in the system. The vulnerability is particularly concerning due to its dependence on the struct layout, which may not always manifest as a crash but can lead to severe operational issues.
How To Fix
Minimum fixed version
6.1.133-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workaround is provided for this vulnerability. Users are advised to apply the patch as soon as it becomes available or to upgrade to the fixed version of the Linux kernel.
Conclusion
CVE-2025-21919 is a significant vulnerability in the Linux kernel that can lead to memory corruption and unpredictable system behavior. Users are encouraged to update their systems to the patched version to mitigate risks. Continuous monitoring for vulnerabilities is essential for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21919 is a vulnerability in the Linux kernel that can lead to memory corruption due to improper handling of pointers.
This vulnerability can cause memory faults or access to garbage data, potentially leading to unpredictable behavior in the system.
Yes, a patch is available for Debian 13 in version 6.12.19-1. Users should update their kernel to this version.
While no specific workaround is provided, it is recommended to monitor for updates and apply the patch as soon as it is available.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
