CVE-2025-21919: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21919 Overview

A memory corruption vulnerability has been identified in the Linux kernel's Completely Fair Scheduler (CFS) subsystem. The vulnerability exists in the child_cfs_rq_on_list function, which attempts to convert a prev pointer to a cfs_rq structure. When this pointer originates from struct rq's leaf_cfs_rq_list, the conversion becomes invalid, potentially leading to memory corruption, system instability, or unpredictable behavior.

Critical Impact
Local attackers with low privileges can exploit this vulnerability to achieve high impact on confidentiality, integrity, and availability of affected Linux systems. The memory corruption can lead to arbitrary code execution or denial of service conditions.

Affected Products

Linux Kernel versions prior to patched releases
Linux Kernel 6.14 RC1 through RC5
Multiple stable kernel branches (see vendor advisories for specific versions)

Discovery Timeline

April 1, 2025 - CVE-2025-21919 published to NVD
November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2025-21919

Vulnerability Analysis

The vulnerability stems from improper pointer handling within the Linux kernel's CFS scheduler. The child_cfs_rq_on_list function performs a container_of operation to convert a list entry pointer to its containing cfs_rq structure. However, the function fails to account for cases where the prev pointer points to rq->leaf_cfs_rq_list rather than a legitimate cfs_rq list entry.

In the list_add_leaf_cfs_rq function, both cfs_rq->leaf_cfs_rq_list and rq->leaf_cfs_rq_list can be added to the same leaf list. Additionally, rq->tmp_alone_branch can be set to rq->leaf_cfs_rq_list. When the container_of macro attempts to derive the parent structure from an invalid pointer, it calculates an incorrect memory address based on the assumed offset of the list member within the cfs_rq structure.

This vulnerability is classified as CWE-787 (Out-of-Bounds Write). Depending on the relative positions of leaf_cfs_rq_list and the task group (tg) pointer within the struct layout, exploitation can cause a memory fault or result in access to garbage data, potentially corrupting adjacent memory regions.

Root Cause

The root cause is a missing bounds check in child_cfs_rq_on_list that fails to validate whether the prev pointer actually belongs to a cfs_rq structure before performing the container_of conversion. The function assumes all list entries in the traversal are embedded within cfs_rq structures, but rq->leaf_cfs_rq_list violates this assumption.

Attack Vector

The vulnerability requires local access to the system with low privileges. An attacker could potentially trigger the vulnerable code path through scheduler manipulation, causing the improper pointer conversion to occur. Since only cfs_rq entries on the same CPU are added to the list, the attack surface is limited to operations affecting the local CPU's scheduler state.

The fix introduces a check if (prev == &rq->leaf_cfs_rq_list) after the main conditional in child_cfs_rq_on_list. This ensures that the container_of operation only processes valid cfs_rq structures by verifying the prev pointer against the current run queue's list head before attempting the conversion.

Detection Methods for CVE-2025-21919

Indicators of Compromise

Unexpected kernel panics or oops messages referencing the scheduler subsystem
Memory corruption errors in kernel logs involving sched/fair or CFS-related functions
System instability or crashes during high task group scheduling activity
Kernel crash dumps showing corruption in cfs_rq or related scheduler structures

Detection Strategies

Monitor kernel logs for scheduler-related memory faults or invalid memory access errors
Deploy kernel memory debugging tools (KASAN, KMSAN) to detect out-of-bounds memory operations
Use ftrace or perf to trace child_cfs_rq_on_list and related scheduler functions for anomalous behavior
Implement crash dump analysis to identify exploitation attempts targeting the CFS scheduler

Monitoring Recommendations

Enable kernel address sanitizer (KASAN) on non-production systems to detect memory corruption
Configure kernel panic reporting to capture and analyze scheduler-related crashes
Monitor system stability metrics for unexpected reboots or scheduler anomalies
Review audit logs for unusual process scheduling patterns that could indicate exploitation attempts

How to Mitigate CVE-2025-21919

Immediate Actions Required

Apply the official kernel patches from the Linux kernel stable branches immediately
Prioritize patching systems where untrusted users have local access
Consider restricting access to systems running vulnerable kernel versions until patches are applied
Monitor affected systems for signs of exploitation or system instability

Patch Information

The Linux kernel maintainers have released patches across multiple stable branches. The fix adds a validation check to ensure the prev pointer is not pointing to rq->leaf_cfs_rq_list before performing the container_of operation. Apply patches from the following commits:

Debian users should refer to the Debian LTS Announcement for distribution-specific packages.

Workarounds

Limit local user access on systems running vulnerable kernel versions to trusted users only
Monitor scheduler subsystem behavior closely on systems that cannot be immediately patched
Consider implementing additional access controls or container isolation to limit potential attack vectors
Evaluate the feasibility of using real-time or alternative scheduling classes for critical workloads

bash

# Check current kernel version
uname -r

# Verify if patch is applied by checking kernel version against fixed releases
# Update kernel using package manager (Debian/Ubuntu example)
sudo apt update && sudo apt upgrade linux-image-$(uname -r)

# Reboot to apply new kernel
sudo reboot