CVE-2025-21919

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-21919
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21919.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21919
Downstream
Related
Published
2025-04-01T15:40:54.075Z
Modified
2026-03-20T12:41:14.200590Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
sched/fair: Fix potential memory corruption in child_cfs_rq_on_list
Details

In the Linux kernel, the following vulnerability has been resolved:

sched/fair: Fix potential memory corruption in childcfsrqonlist

childcfsrqonlist attempts to convert a 'prev' pointer to a cfsrq. This 'prev' pointer can originate from struct rq's leafcfsrqlist, making the conversion invalid and potentially leading to memory corruption. Depending on the relative positions of leafcfsrq_list and the task group (tg) pointer within the struct, this can cause a memory fault or access garbage data.

The issue arises in listaddleafcfsrq, where both cfsrq->leafcfsrqlist and rq->leafcfsrqlist are added to the same leaf list. Also, rq->tmpalonebranch can be set to rq->leafcfsrqlist.

This adds a check if (prev == &rq->leaf_cfs_rq_list) after the main conditional in childcfsrqonlist. This ensures that the containerof operation will convert a correct cfsrq struct.

This check is sufficient because only cfs_rqs on the same CPU are added to the list, so verifying the 'prev' pointer against the current rq's list head is enough.

Fixes a potential memory corruption issue that due to current struct layout might not be manifesting as a crash but could lead to unpredictable behavior when the layout changes.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21919.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
fdaba61ef8a268d4136d0a113d153f7a89eb9984
Fixed
5cb300dcdd27e6a351ac02541e0231261c775852
Fixed
000c9ee43928f2ce68a156dd40bab7616256f4dd
Fixed
9cc7f0018609f75a349e42e3aebc3b0e905ba775
Fixed
b5741e4b9ef3567613b2351384f91d3f16e59986
Fixed
e1dd09df30ba86716cb2ffab97dc35195c01eb8f
Fixed
3b4035ddbfc8e4521f85569998a7569668cccf51

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21919.json"