Security readout for executives and security teams
Plain-English summary
CVE-2025-21861 is a Linux kernel memory-management bug in device page migration. A local low-privileged user may be able to trigger a kernel warning or availability impact in affected kernels. The source text suggests the direct observed effect is memcg complaining during HMM tests, and says likely nothing else goes wrong.
Executive priority
Treat this as a moderate Linux availability issue. It is not supported as remotely exploitable or actively exploited, but kernel-level availability bugs can matter on shared compute, industrial systems, and hosts running untrusted local workloads.
Technical view
The flaw is in mm/migrate_device migrate_device_finalize(). During migration success or failure, a folio with memcg_data set to zero could be passed to folio_putback_lru(), adding a folio intended to be freed back to the LRU. The CVE is classified as CWE-416 with CVSS 3.1 score 5.5, local attack vector, low privileges, and high availability impact.
Likely exposure
Exposure is mainly Linux systems running affected kernel versions or vendor products incorporating them, especially systems using heterogeneous memory management or device-private page migration paths. The bundle also includes a Siemens advisory, so embedded or industrial products using affected Linux kernels should be checked against vendor guidance.
Exploitation context
The bundle does not show CISA KEV listing or active exploitation. Exploitation is characterized as local, low-complexity, and requiring low privileges with no user interaction. No remote attack path is supported by the provided sources.
Researcher notes
The source description is unusually conservative, stating the observed behavior may only add unnecessary LRU work and trigger memcg warnings. Risk scoring still assigns high availability impact. Validation should focus on affected kernel lineage, backported fix status, and whether relevant migration paths are reachable in the target environment.
Mitigation direction
- Apply the relevant Linux stable kernel update or vendor kernel package containing the referenced fixes.
- Check Siemens SSA-019113 if operating Siemens products that may embed affected Linux kernels.
- Prioritize systems where local untrusted users, containers, or workloads can reach affected kernel paths.
- If no vendor package exists, follow vendor guidance for supported backports or compensating controls.
Validation and detection
- Inventory Linux kernel versions and compare them with vendor advisories and stable fix references.
- Confirm whether the environment uses hardware or drivers relying on HMM or device-private page migration.
- Review kernel logs for matching memcg or folio_lruvec warning patterns during testing.
- Track package manager or SBOM evidence showing the corrected kernel build is installed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-21861 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/61fa824e304ed162fe965f64999068e6fcff2059CVE reference, Linux
- https://git.kernel.org/stable/c/64397b0cb7c09e3ef3f9f5c7c17299c4eebd3875CVE reference, Linux
- https://git.kernel.org/stable/c/4f52f7c50f5b6f5eeb06823e21fe546d90f9c595CVE reference, Linux
- https://git.kernel.org/stable/c/20fb6fc51863fbff7868de8b5f6d249d2094df1fCVE reference, Linux
- https://git.kernel.org/stable/c/78f579cb7d825134e071a1714d8d0c4fd0ffe459CVE reference, Linux
- https://git.kernel.org/stable/c/3f9240d59e9a95d19f06120bfd1d0e681c6c0ac7CVE reference, Linux
- https://git.kernel.org/stable/c/069dd21ea8262204f94737878389c2815a054a9eCVE reference, Linux
- https://git.kernel.org/stable/c/41cddf83d8b00f29fd105e7a0777366edc69a5cfCVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.