CVE-2025-21860

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/zswap: fix inconsistency when zswap_store_page() fails

Commit b7c0ccdfbafd ("mm: zswap: support large folios in zswap_store()")

skips charging any zswap entries when it failed to zswap the entire folio.

However, when some base pages are zswapped but it failed to zswap the

entire folio, the zswap operation is rolled back. When freeing zswap

entries for those pages, zswap_entry_free() uncharges the zswap entries

that were not previously charged, causing zswap charging to become

inconsistent.

This inconsistency triggers two warnings with following steps:

# On a machine with 64GiB of RAM and 36GiB of zswap

$ stress-ng --bigheap 2 # wait until the OOM-killer kills stress-ng

$ sudo reboot

The two warnings are:

in mm/memcontrol.c:163, function obj_cgroup_release():

WARN_ON_ONCE(nr_bytes & (PAGE_SIZE - 1));

in mm/page_counter.c:60, function page_counter_cancel():

if (WARN_ONCE(new < 0, "pa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References