CVE-2025-68248

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vmw_balloon: indicate success when effectively deflating during migration

When migrating a balloon page, we first deflate the old page to then

inflate the new page.

However, if inflating the new page succeeded, we effectively deflated the

old page, reducing the balloon size.

In that case, the migration actually worked: similar to migrating+

immediately deflating the new page. The old page will be freed back to

the buddy.

Right now, the core will leave the page be marked as isolated (as we

returned an error). When later trying to putback that page, we will run

into the WARN_ON_ONCE() in balloon_page_putback().

That handling was changed in commit 3544c4faccb8 ("mm/balloon_compaction:

stop using __ClearPageMovable()"); before that change, we would have

tolerated that way of handling it.

To fix it, let's just return 0 in that case, making the core effectively

just clear the "isolated" flag + freeing it back to the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References