Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw can crash affected systems when handling a rare memory-management path: offlining a hardware-poisoned memory page. The available sources describe a kernel BUG/Oops, which points mainly to availability risk. There is no evidence in the bundle of active exploitation or remote attackability.
Executive priority
Handle through normal kernel patch governance, with higher priority for virtualization, cloud, high-availability, or hardware-error-prone systems. Current evidence supports moderate urgency: availability impact is credible, but the bundle does not show active exploitation, remote reachability, or privilege escalation.
Technical view
The issue is in hwpoison and memory_hotplug handling. The kernel attempted try_to_unmap on a hwpoisoned folio without first holding the folio lock, violating a required locking precondition and triggering a BUG/Oops during memory offlining. The resolved change adds the folio lock before unmapping.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions or downstream kernels containing the vulnerable memory hotplug and hwpoison code path. Systems that use memory offlining, memory hotplug, or hardware-poison handling deserve closer review. Product and distribution backports must be checked because source commit ranges alone may not match packaged kernels.
Exploitation context
The source bundle does not show KEV listing, public exploitation, or a complete exploitation path. The demonstrated failure occurs during memory offlining of a hwpoisoned page and results in a kernel Oops. Treat this as a plausible local availability issue until vendor advisories provide stronger impact details.
Researcher notes
Key evidence is the upstream kernel description and stable commit references. The crash trace reaches try_to_unmap via unmap_poisoned_folio, do_migrate_range, and offline_pages. Impact details remain narrow in the public bundle; downstream vendor advisories are needed to confirm affected packaged kernels and operational severity.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Review Linux distribution advisories for CVE-2025-21931 coverage.
- Prioritize systems using memory hotplug, memory offlining, or hwpoison handling.
- Plan reboot or live-patching according to vendor kernel guidance.
- Track Debian LTS and other distro advisories for backported fixes.
Validation and detection
- Inventory running Linux kernel versions across affected fleets.
- Compare vendor kernel changelogs against CVE-2025-21931 and referenced commits.
- Confirm whether memory hotplug or hwpoison workflows are enabled or used.
- Review kernel logs for BUG/Oops events during memory offline operations.
- After remediation, verify systems booted into the patched kernel.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21931 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3926b572fd073491bde13ec42ee08ac1b337bf4dCVE reference, Linux
- https://git.kernel.org/stable/c/93df6da64b004f75d307ed08d3f0f1020280d339CVE reference, Linux
- https://git.kernel.org/stable/c/576a2f4c437c19bec7d05d05b5990f178d2b0f40CVE reference, Linux
- https://git.kernel.org/stable/c/629dfc6ba5431056701d4e44830f3409b989955aCVE reference, Linux
- https://git.kernel.org/stable/c/af288a426c3e3552b62595c6138ec6371a17dbbaCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/08/msg00010.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.