Critical Memory Management Vulnerability in Linux Kernel (Debian 13 & 14)
Summary
DEBIAN-CVE-2025-21861: In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() If migration succeeded, we called folio_migrate_flags()->mem_cgroup_m... Affects linux versions < 6.12.17-1. Fixed in 6.12.17-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used across various distributions, including Debian. The kernel's memory management subsystem is crucial for efficient resource allocation and system stability. However, vulnerabilities in this subsystem can lead to severe consequences, including system crashes and security breaches.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the memory management subsystem, specifically in the 'migrate_device_finalize()' function. This issue arises when migrating memory cgroups (memcgs) between folios. If migration succeeds, the old folio's memcg_data is set to zero, and if it fails, the destination folio's memcg_data remains unset. This inconsistency can lead to the folio being incorrectly added to the Least Recently Used (LRU) list, causing potential memory management issues and warnings during operations. The vulnerability can be exploited during memory migration processes, leading to instability and unexpected behavior in the system.
How To Fix
Minimum fixed version
6.12.17-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux kernel to the fixed version.
Conclusion
The identified vulnerability in the Linux kernel's memory management subsystem poses significant risks to system stability and security. Users are strongly encouraged to update their kernel to the patched version '6.12.17-1' to mitigate these risks. Utilizing tools like Vulert can further enhance your ability to monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to memory management issues, system instability, and potential crashes during memory migration operations.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, the patched version of the Linux kernel is '6.12.17-1' for both Debian 13 and 14.
While there are no specific workarounds, it is advisable to monitor your system closely for any unusual behavior until you can apply the patch.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in your software, providing an easy way to stay informed.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
