CVE-2025-21861

A vulnerability was found in the Linux kernel's memory migration system in the migrate_device_finalize() function, where a folio that should be freed is erroneously added back into the Least Recently Used (LRU) list. This issue can lead to memory corruption caused by a use-after-free issue when a previously freed folio is reaccessed, leading to system instability or potential denial of service.

This vulnerability is rated as Moderate because exploitation requires local system access and specific workflows involving heterogeneous memory management to trigger the flaw, limiting the blast radius primarily to a kernel crash or denial of service rather than code execution. In typical Red Hat Enterprise Linux deployments, device-specific memory migration is exercised only when utilizing specialized hardware drivers that support private device folios. Consequently, standard workloads remain unaffected unless a local user can invoke device memory migration paths to trigger internal memory accounting inconsistencies.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.