CVE-2025-21932

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: abort vma_modify() on merge out of memory failure

The remainder of vma_modify() relies upon the vmg state remaining pristine

after a merge attempt.

Usually this is the case, however in the one edge case scenario of a merge

attempt failing not due to the specified range being unmergeable, but

rather due to an out of memory error arising when attempting to commit the

merge, this assumption becomes untrue.

This results in vmg->start, end being modified, and thus the proceeding

attempts to split the VMA will be done with invalid start/end values.

Thankfully, it is likely practically impossible for us to hit this in

reality, as it would require a maple tree node pre-allocation failure that

would likely never happen due to it being 'too small to fail', i.e. the

kernel would simply keep retrying reclaim until it succeeded.

However, this scenario remains theoretically possible, and what we are

doing here is wrong so

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References