NVD

CVE-2025-21861 Detail

Modified After Enrichment

This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.

Description

In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() If migration succeeded, we called folio_migrate_flags()->mem_cgroup_migrate() to migrate the memcg from the old to the new folio. This will set memcg_data of the old folio to 0. Similarly, if migration failed, memcg_data of the dst folio is left unset. If we call folio_putback_lru() on such folios (memcg_data == 0), we will add the folio to be freed to the LRU, making memcg code unhappy. Running the hmm selftests: # ./hmm-tests ... # RUN hmm.hmm_device_private.migrate ... [ 102.078007][T14893] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7ff27d200 pfn:0x13cc00 [ 102.079974][T14893] anon flags: 0x17ff00000020018(uptodate|dirty|swapbacked|node=0|zone=2|lastcpupid=0x7ff) [ 102.082037][T14893] raw: 017ff00000020018 dead000000000100 dead000000000122 ffff8881353896c9 [ 102.083687][T14893] raw: 00000007ff27d200 0000000000000000 00000001ffffffff 0000000000000000 [ 102.085331][T14893] page dumped because: VM_WARN_ON_ONCE_FOLIO(!memcg && !mem_cgroup_disabled()) [ 102.087230][T14893] ------------[ cut here ]------------ [ 102.088279][T14893] WARNING: CPU: 0 PID: 14893 at ./include/linux/memcontrol.h:726 folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.090478][T14893] Modules linked in: [ 102.091244][T14893] CPU: 0 UID: 0 PID: 14893 Comm: hmm-tests Not tainted 6.13.0-09623-g6c216bc522fd #151 [ 102.093089][T14893] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 [ 102.094848][T14893] RIP: 0010:folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.096104][T14893] Code: ... [ 102.099908][T14893] RSP: 0018:ffffc900236c37b0 EFLAGS: 00010293 [ 102.101152][T14893] RAX: 0000000000000000 RBX: ffffea0004f30000 RCX: ffffffff8183f426 [ 102.102684][T14893] RDX: ffff8881063cb880 RSI: ffffffff81b8117f RDI: ffff8881063cb880 [ 102.104227][T14893] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 [ 102.105757][T14893] R10: 0000000000000001 R11: 0000000000000002 R12: ffffc900236c37d8 [ 102.107296][T14893] R13: ffff888277a2bcb0 R14: 000000000000001f R15: 0000000000000000 [ 102.108830][T14893] FS: 00007ff27dbdd740(0000) GS:ffff888277a00000(0000) knlGS:0000000000000000 [ 102.110643][T14893] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 102.111924][T14893] CR2: 00007ff27d400000 CR3: 000000010866e000 CR4: 0000000000750ef0 [ 102.113478][T14893] PKRU: 55555554 [ 102.114172][T14893] Call Trace: [ 102.114805][T14893] <TASK> [ 102.115397][T14893] ? folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.116547][T14893] ? __warn.cold+0x110/0x210 [ 102.117461][T14893] ? folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.118667][T14893] ? report_bug+0x1b9/0x320 [ 102.119571][T14893] ? handle_bug+0x54/0x90 [ 102.120494][T14893] ? exc_invalid_op+0x17/0x50 [ 102.121433][T14893] ? asm_exc_invalid_op+0x1a/0x20 [ 102.122435][T14893] ? __wake_up_klogd.part.0+0x76/0xd0 [ 102.123506][T14893] ? dump_page+0x4f/0x60 [ 102.124352][T14893] ? folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.125500][T14893] folio_batch_move_lru+0xd4/0x200 [ 102.126577][T14893] ? __pfx_lru_add+0x10/0x10 [ 102.127505][T14893] __folio_batch_add_and_move+0x391/0x720 [ 102.128633][T14893] ? __pfx_lru_add+0x10/0x10 [ 102.129550][T14893] folio_putback_lru+0x16/0x80 [ 102.130564][T14893] migrate_device_finalize+0x9b/0x530 [ 102.131640][T14893] dmirror_migrate_to_device.constprop.0+0x7c5/0xad0 [ 102.133047][T14893] dmirror_fops_unlocked_ioctl+0x89b/0xc80 Likely, nothing else goes wrong: putting the last folio reference will remove the folio from the LRU again. So besides memcg complaining, adding the folio to be freed to the LRU is just an unnecessary step. The new flow resembles what we have in migrate_folio_move(): add the dst to the lru, rem ---truncated---

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score: 5.5 MEDIUM

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

ADP: CISA-ADP

Base Score: 5.5 MEDIUM

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL	Source(s)	Tag(s)
https://cert-portal.siemens.com/productcert/html/ssa-019113.html	siemens-SADP
https://git.kernel.org/stable/c/069dd21ea8262204f94737878389c2815a054a9e	kernel.org	Patch
https://git.kernel.org/stable/c/20fb6fc51863fbff7868de8b5f6d249d2094df1f	kernel.org
https://git.kernel.org/stable/c/3f9240d59e9a95d19f06120bfd1d0e681c6c0ac7	kernel.org	Patch
https://git.kernel.org/stable/c/41cddf83d8b00f29fd105e7a0777366edc69a5cf	kernel.org	Patch
https://git.kernel.org/stable/c/4f52f7c50f5b6f5eeb06823e21fe546d90f9c595	kernel.org
https://git.kernel.org/stable/c/61fa824e304ed162fe965f64999068e6fcff2059	kernel.org
https://git.kernel.org/stable/c/64397b0cb7c09e3ef3f9f5c7c17299c4eebd3875	kernel.org
https://git.kernel.org/stable/c/78f579cb7d825134e071a1714d8d0c4fd0ffe459	kernel.org

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-416	Use After Free	NIST CISA-ADP

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

7 change records found show changes

CVE Modified by siemens-SADP 7/14/2026 9:17:25 AM

Action

Type

Old Value

New Value

Added

Reference

https://cert-portal.siemens.com/productcert/html/ssa-019113.html

Added

Affected

[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","lessThan":"*","versionType":"custom","status":"affected"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","lessThan":"*","versionType":"custom","status":"affected"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","lessThan":"*","versionType":"custom","status":"affected"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","lessThan":"*","versionType":"custom","status":"affected"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","lessThan":"*","versionType":"custom","status":"affected"}]}]

CVE Modified by kernel.org 6/17/2026 4:44:28 AM

Action

Type

Old Value

New Value

Added

Affected

Record truncated, showing 2048 of 2452 characters.
View Entire Change Record

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/migrate_device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8763cb45ab967a92a5ee49e9c544c0f0ea90e2d6","lessThan":"61fa824e304ed162fe965f64999068e6fcff2059","versionType":"git","status":"affected"},{"version":"8763cb45ab967a92a5ee49e9c544c0f0ea90e2d6","lessThan":"64397b0cb7c09e3ef3f9f5c7c17299c4eebd3875","versionType":"git","status":"affected"},{"version":"8763cb45ab967a92a5ee49e9c544c0f0ea90e2d6","lessThan":"4f52f7c50f5b6f5eeb06823e21fe546d90f9c595","versionType":"git","status":"affected"},{"version":"8763cb45ab967a92a5ee49e9c544c0f0ea90e2d6","lessThan":"20fb6fc51863fbff7868de8b5f6d249d2094df1f","versionType":"git","status":"affected"},{"version":"8763cb45ab967a92a5ee49e9c544c0f0ea90e2d6","lessThan":"78f579cb7d825134e071a1714d8d0c4fd0ffe459","versionType":"git","status":"affected"},{"version":"8763cb45ab967a92a5ee49e9c544c0f0ea90e2d6","lessThan":"3f9240d59e9a95d19f06120bfd1d0e681c6c0ac7","versionType":"git","status":"affected"},{"version":"8763cb45ab967a92a5ee49e9c544c0f0ea90e2d6","lessThan":"069dd21ea8262204f94737878389c2815a054a9e","versionType":"git","status":"affected"},{"version":"8763cb45ab967a92a5ee49e9c544c0f0ea90e2d6","lessThan":"41cddf83d8b00f29fd105e7a0777366edc69a5cf","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/migrate_device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","versionType":"semver","status":"unaffected"},{"version":"5.4.300","lessThanOrEqual":"5.4.*","versionType":"semver","status":"unaffected"},{"version":"5.10.245","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.194","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.155","lessThanOrEqual":"6.1.*","versionType":"semver","sta

CVE Modified by kernel.org 10/02/2025 10:15:43 AM

Action	Type	New Value
Added	Reference	https://git.kernel.org/stable/c/20fb6fc51863fbff7868de8b5f6d249d2094df1f
Added	Reference	https://git.kernel.org/stable/c/4f52f7c50f5b6f5eeb06823e21fe546d90f9c595
Added	Reference	https://git.kernel.org/stable/c/61fa824e304ed162fe965f64999068e6fcff2059
Added	Reference	https://git.kernel.org/stable/c/64397b0cb7c09e3ef3f9f5c7c17299c4eebd3875
Added	Reference	https://git.kernel.org/stable/c/78f579cb7d825134e071a1714d8d0c4fd0ffe459

Initial Analysis by NIST 3/13/2025 5:14:01 PM

Action	Type	New Value
Added	CVSS V3.1	AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Added	CWE	CWE-416
Added	CPE Configuration	OR cpe:2.3:o:linux:linux_kernel:6.14:rc1::::::* cpe:2.3:o:linux:linux_kernel:6.14:rc2::::::* cpe:2.3:o:linux:linux_kernel:6.14:rc3::::::* cpe:2.3:o:linux:linux_kernel::::::::* versions from (including) 6.13 from (excluding) 6.13.5 cpe:2.3:o:linux:linux_kernel::::::::* versions from (including) 4.14 from (excluding) 6.12.17
Added	Reference Type	kernel.org: https://git.kernel.org/stable/c/069dd21ea8262204f94737878389c2815a054a9e Types: Patch
Added	Reference Type	kernel.org: https://git.kernel.org/stable/c/3f9240d59e9a95d19f06120bfd1d0e681c6c0ac7 Types: Patch
Added	Reference Type	kernel.org: https://git.kernel.org/stable/c/41cddf83d8b00f29fd105e7a0777366edc69a5cf Types: Patch

New CVE Received from kernel.org 3/12/2025 6:15:19 AM

Action	Type	New Value
Added	Description	Record truncated, showing 2048 of 3998 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() If migration succeeded, we called folio_migrate_flags()->mem_cgroup_migrate() to migrate the memcg from the old to the new folio. This will set memcg_data of the old folio to 0. Similarly, if migration failed, memcg_data of the dst folio is left unset. If we call folio_putback_lru() on such folios (memcg_data == 0), we will add the folio to be freed to the LRU, making memcg code unhappy. Running the hmm selftests: # ./hmm-tests ... # RUN hmm.hmm_device_private.migrate ... [ 102.078007][T14893] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7ff27d200 pfn:0x13cc00 [ 102.079974][T14893] anon flags: 0x17ff00000020018(uptodate\|dirty\|swapbacked\|node=0\|zone=2\|lastcpupid=0x7ff) [ 102.082037][T14893] raw: 017ff00000020018 dead000000000100 dead000000000122 ffff8881353896c9 [ 102.083687][T14893] raw: 00000007ff27d200 0000000000000000 00000001ffffffff 0000000000000000 [ 102.085331][T14893] page dumped because: VM_WARN_ON_ONCE_FOLIO(!memcg && !mem_cgroup_disabled()) [ 102.087230][T14893] ------------[ cut here ]------------ [ 102.088279][T14893] WARNING: CPU: 0 PID: 14893 at ./include/linux/memcontrol.h:726 folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.090478][T14893] Modules linked in: [ 102.091244][T14893] CPU: 0 UID: 0 PID: 14893 Comm: hmm-tests Not tainted 6.13.0-09623-g6c216bc522fd #151 [ 102.093089][T14893] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 [ 102.094848][T14893] RIP: 0010:folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.096104][T14893] Code: ... [ 102.099908][T14893] RSP: 0018:ffffc900236c37b0 EFLAGS: 00010293 [ 102.101152][T14893] RAX: 0000000000000000 RBX: ffffea0004f30000 RCX: ffffffff8183f426 [ 102.102684][T14893] RDX: ffff8881063cb880 RSI: ffffffff81b8117f RDI: ffff8881063cb880 [ 102.104227][T14893] RBP: 0000000000000000 R08: 0000000000000005
Added	Reference	https://git.kernel.org/stable/c/069dd21ea8262204f94737878389c2815a054a9e
Added	Reference	https://git.kernel.org/stable/c/3f9240d59e9a95d19f06120bfd1d0e681c6c0ac7
Added	Reference	https://git.kernel.org/stable/c/41cddf83d8b00f29fd105e7a0777366edc69a5cf

Quick Info

CVE Dictionary Entry:
CVE-2025-21861
NVD Published Date:
03/12/2025
NVD Last Modified:
07/14/2026
Source:
kernel.org

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

CVE-2025-21861 Detail

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

CVE Modified by siemens-SADP 7/14/2026 9:17:25 AM

CVE Modified by CISA-ADP 6/17/2026 4:44:28 AM

CVE Modified by kernel.org 6/17/2026 4:44:28 AM

CVE Modified by kernel.org 10/02/2025 10:15:43 AM

CVE Modified by CISA-ADP 10/01/2025 4:18:30 PM

Initial Analysis by NIST 3/13/2025 5:14:01 PM

New CVE Received from kernel.org 3/12/2025 6:15:19 AM

Quick Info