CVE-2025-21919

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched/fair: Fix potential memory corruption in child_cfs_rq_on_list

child_cfs_rq_on_list attempts to convert a 'prev' pointer to a cfs_rq.

This 'prev' pointer can originate from struct rq's leaf_cfs_rq_list,

making the conversion invalid and potentially leading to memory

corruption. Depending on the relative positions of leaf_cfs_rq_list and

the task group (tg) pointer within the struct, this can cause a memory

fault or access garbage data.

The issue arises in list_add_leaf_cfs_rq, where both

cfs_rq->leaf_cfs_rq_list and rq->leaf_cfs_rq_list are added to the same

leaf list. Also, rq->tmp_alone_branch can be set to rq->leaf_cfs_rq_list.

This adds a check `if (prev == &rq->leaf_cfs_rq_list)` after the main

conditional in child_cfs_rq_on_list. This ensures that the container_of

operation will convert a correct cfs_rq struct.

This check is sufficient because only cfs_rqs on the same CPU are added

to the list, so verif

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References