CVE-2025-21932

A flaw was found in the Linux kernel's memory management subsystem. When an out-of-memory condition occurs while attempting to merge virtual memory areas (VMAs), the kernel fails to properly abort the modification process. This failure leaves internal memory boundary tracking in an inconsistent state, causing subsequent operations to proceed with invalid address ranges. A local user could exploit this issue during memory pressure to crash the system, leading to a denial of service (DoS).

Red Hat has evaluated this vulnerability as having a Low security impact because triggering it requires severe, near-fatal memory exhaustion alongside specific virtual memory boundary manipulation by a local user. In standard environments, small memory allocations for internal memory mapping structures are prioritized and repeatedly retried by the kernel rather than failing outright, rendering practical exploitation highly improbable. Consequently, the flaw presents minimal operational risk beyond existing system distress during catastrophic out-of-memory states.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.