CVE-2025-21931

一、漏洞信息
 漏洞编号：[CVE-2025-21931](https://nvd.nist.gov/vuln/detail/CVE-2025-21931)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folioCommit b15c87263a69 ( hwpoison, memory_hotplug: allow hwpoisoned pages tobe offlined) add page poison checks in do_migrate_range in order to makeoffline hwpoisoned page possible by introducing isolate_lru_page andtry_to_unmap for hwpoisoned page.  However folio lock must be held beforecalling try_to_unmap.  Add it to fix this problem.Warning will be produced if folio is not locked during unmap:  ------------[ cut here ]------------  kernel BUG at ./include/linux/swapops.h:400!  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP  Modules linked in:  CPU: 4 UID: 0 PID: 411 Comm: bash Tainted: G        W          6.13.0-rc1-00016-g3c434c7ee82a-dirty #41  Tainted: [W]=WARN  Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015  pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)  pc : try_to_unmap_one+0xb08/0xd3c  lr : try_to_unmap_one+0x3dc/0xd3c  Call trace:   try_to_unmap_one+0xb08/0xd3c (P)   try_to_unmap_one+0x3dc/0xd3c (L)   rmap_walk_anon+0xdc/0x1f8   rmap_walk+0x3c/0x58   try_to_unmap+0x88/0x90   unmap_poisoned_folio+0x30/0xa8   do_migrate_range+0x4a0/0x568   offline_pages+0x5a4/0x670   memory_block_action+0x17c/0x374   memory_subsys_offline+0x3c/0x78   device_offline+0xa4/0xd0   state_store+0x8c/0xf0   dev_attr_store+0x18/0x2c   sysfs_kf_write+0x44/0x54   kernfs_fop_write_iter+0x118/0x1a8   vfs_write+0x3a8/0x4bc   ksys_write+0x6c/0xf8   __arm64_sys_write+0x1c/0x28   invoke_syscall+0x44/0x100   el0_svc_common.constprop.0+0x40/0xe0   do_el0_svc+0x1c/0x28   el0_svc+0x30/0xd0   el0t_64_sync_handler+0xc8/0xcc   el0t_64_sync+0x198/0x19c  Code: f9407be0 b5fff320 d4210000 17ffff97 (d4210000)  ---[ end trace 0000000000000000 ]---
 漏洞公开时间：2025-04-02 00:15:23
 漏洞创建时间：2025-04-02 01:00:13
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-21931
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3926b572fd073491bde13ec42ee08ac1b337bf4d |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/576a2f4c437c19bec7d05d05b5990f178d2b0f40 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/629dfc6ba5431056701d4e44830f3409b989955a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/93df6da64b004f75d307ed08d3f0f1020280d339 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/af288a426c3e3552b62595c6138ec6371a17dbba |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-21931 | https://bugzilla.suse.com/show_bug.cgi?id=1240709 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-21931 | https://bugzilla.suse.com/show_bug.cgi?id=1240709 |
| suse_bugzilla | https://git.kernel.org/stable/c/576a2f4c437c19bec7d05d05b5990f178d2b0f40 | https://bugzilla.suse.com/show_bug.cgi?id=1240709 |
| suse_bugzilla | https://git.kernel.org/stable/c/629dfc6ba5431056701d4e44830f3409b989955a | https://bugzilla.suse.com/show_bug.cgi?id=1240709 |
| suse_bugzilla | https://git.kernel.org/stable/c/af288a426c3e3552b62595c6138ec6371a17dbba | https://bugzilla.suse.com/show_bug.cgi?id=1240709 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2356641 | https://bugzilla.suse.com/show_bug.cgi?id=1240709 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-21931.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1240709 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025040133-CVE-2025-21931-3d56@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2356641 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2025-21931 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux_kernel | 6.12.19 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=576a2f4c437c19bec7d05d05b5990f178d2b0f40Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b15c87263a69272423771118c653e9a1d0672caa | linuxkernelcves |
| linux_kernel | 6.13.7 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=629dfc6ba5431056701d4e44830f3409b989955aIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b15c87263a69272423771118c653e9a1d0672caa | linuxkernelcves |
| linux_kernel | 6.14 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=af288a426c3e3552b62595c6138ec6371a17dbbaIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b15c87263a69272423771118c653e9a1d0672caa | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
                            In the Linux kernel, the following vulnerability has been resolved:hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folioCommit b15c87263a69 ( hwpoison, memory_hotplug: allow hwpoisoned pages tobe offlined) add page poison checks in do_migrate_range in order to makeoffline hwpoisoned page possible by introducing isolate_lru_page andtry_to_unmap for hwpoisoned page.  However folio lock must be held beforecalling try_to_unmap.  Add it to fix this problem.Warning will be produced if folio is not locked during unmap:  ------------[ cut here ]------------  kernel BUG at ./include/linux/swapops.h:400!  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP  Modules linked in:  CPU: 4 UID: 0 PID: 411 Comm: bash Tainted: G        W          6.13.0-rc1-00016-g3c434c7ee82a-dirty #41  Tainted: [W]=WARN  Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015  pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)  pc : try_to_unmap_one+0xb08/0xd3c  lr : try_to_unmap_one+0x3dc/0xd3c  Call trace:   try_to_unmap_one+0xb08/0xd3c (P)   try_to_unmap_one+0x3dc/0xd3c (L)   rmap_walk_anon+0xdc/0x1f8   rmap_walk+0x3c/0x58   try_to_unmap+0x88/0x90   unmap_poisoned_folio+0x30/0xa8   do_migrate_range+0x4a0/0x568   offline_pages+0x5a4/0x670   memory_block_action+0x17c/0x374   memory_subsys_offline+0x3c/0x78   device_offline+0xa4/0xd0   state_store+0x8c/0xf0   dev_attr_store+0x18/0x2c   sysfs_kf_write+0x44/0x54   kernfs_fop_write_iter+0x118/0x1a8   vfs_write+0x3a8/0x4bc   ksys_write+0x6c/0xf8   __arm64_sys_write+0x1c/0x28   invoke_syscall+0x44/0x100   el0_svc_common.constprop.0+0x40/0xe0   do_el0_svc+0x1c/0x28   el0_svc+0x30/0xd0   el0t_64_sync_handler+0xc8/0xcc   el0t_64_sync+0x198/0x19c  Code: f9407be0 b5fff320 d4210000 17ffff97 (d4210000)  ---[ end trace 0000000000000000 ]---             
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS:受影响
5.openEuler-24.03-LTS-SP1:受影响
6.openEuler-24.03-LTS-SP2:受影响
7.master(6.12.33):不受影响
8.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.12.33):否
4.openEuler-24.03-LTS:否
5.openEuler-24.03-LTS-Next:否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否

原因说明：
  1.openEuler-24.03-LTS:正常修复
2.openEuler-24.03-LTS-SP1:正常修复
3.openEuler-24.03-LTS-SP2:正常修复
4.openEuler-20.03-LTS-SP4(4.19.90):不修复-超出修复范围
5.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
6.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
7.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发

src-openEuler / kernel
Closed

Content Risk Flag

Comments (9)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-21931

Comments (9)

Search

src-openEuler / kernel
Closed