CVE-2025-21931

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-21931
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21931.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21931
Downstream
Related
Published
2025-04-01T15:41:01.055Z
Modified
2025-11-28T02:34:34.719141Z
Summary
hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
Details

In the Linux kernel, the following vulnerability has been resolved:

hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio

Commit b15c87263a69 ("hwpoison, memoryhotplug: allow hwpoisoned pages to be offlined) add page poison checks in domigraterange in order to make offline hwpoisoned page possible by introducing isolatelrupage and trytounmap for hwpoisoned page. However folio lock must be held before calling tryto_unmap. Add it to fix this problem.

Warning will be produced if folio is not locked during unmap:

------------[ cut here ]------------ kernel BUG at ./include/linux/swapops.h:400! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 4 UID: 0 PID: 411 Comm: bash Tainted: G W 6.13.0-rc1-00016-g3c434c7ee82a-dirty #41 Tainted: [W]=WARN Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : trytounmapone+0xb08/0xd3c lr : trytounmapone+0x3dc/0xd3c Call trace: trytounmapone+0xb08/0xd3c (P) trytounmapone+0x3dc/0xd3c (L) rmapwalkanon+0xdc/0x1f8 rmapwalk+0x3c/0x58 trytounmap+0x88/0x90 unmappoisonedfolio+0x30/0xa8 domigraterange+0x4a0/0x568 offlinepages+0x5a4/0x670 memoryblockaction+0x17c/0x374 memorysubsysoffline+0x3c/0x78 deviceoffline+0xa4/0xd0 statestore+0x8c/0xf0 devattrstore+0x18/0x2c sysfskfwrite+0x44/0x54 kernfsfopwriteiter+0x118/0x1a8 vfswrite+0x3a8/0x4bc ksyswrite+0x6c/0xf8 _arm64syswrite+0x1c/0x28 invokesyscall+0x44/0x100 el0svccommon.constprop.0+0x40/0xe0 doel0svc+0x1c/0x28 el0svc+0x30/0xd0 el0t64synchandler+0xc8/0xcc el0t64_sync+0x198/0x19c Code: f9407be0 b5fff320 d4210000 17ffff97 (d4210000) ---[ end trace 0000000000000000 ]---

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21931.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b15c87263a69272423771118c653e9a1d0672caa
Fixed
3926b572fd073491bde13ec42ee08ac1b337bf4d
Fixed
93df6da64b004f75d307ed08d3f0f1020280d339
Fixed
576a2f4c437c19bec7d05d05b5990f178d2b0f40
Fixed
629dfc6ba5431056701d4e44830f3409b989955a
Fixed
af288a426c3e3552b62595c6138ec6371a17dbba
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
85ef35ab972b7484f41c3bb2bbc79de212e19129
Last affected
060853fdd434ce620dd1dd7619ede834bd33b9d0
Last affected
cb1206e85df291fefde27401190329e26996c54c
Last affected
2c25071bed4b1f9c4cfb10a7914847d7069794bf
Last affected
2c87072a3bf9bbcd747618bb2ccc3cd0da181db6
Last affected
a2b977e3d9e4298d28ebe5cfff9e0859b74a7ac7

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
6.1.140
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.92
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.19
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.13.7