High 7.8Published Apr 1, 2025

CVE-2025-21919sched/fair: Fix potential memory corruption in child_cfs_rq_on_list

Updated under an hour ago (Oct 27, 2026, 6:50 PM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list child_cfs_rq_on_list attempts to convert a 'prev' pointer to a cfs_rq. This 'prev' pointer can originate from struct rq's leaf_cfs_rq_list, making the conversion invalid and potentially leading to memory corruption. Depending on the relative positions of leaf_cfs_rq_list and the task group (tg) pointer within the struct, this can cause a memory fault or access garbage data. The issue arises in list_add_leaf_cfs_rq, where both cfs_rq->leaf_cfs_rq_list and rq->leaf_cfs_rq_list are added to the same leaf list. Also, rq->tmp_alone_branch can be set to rq->leaf_cfs_rq_list. This adds a check `if (prev == &rq->leaf_cfs_rq_list)` after the main conditional in child_cfs_rq_on_list. This ensures that the container_of operation will convert a correct cfs_rq struct. This check is sufficient because only cfs_rqs on the same CPU are added to the list, so verifying the 'prev' pointer against the current rq's list head is enough. Fixes a potential memory corruption issue that due to current struct layout might not be manifesting as a crash but could lead to unpredictable behavior when the layout changes.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-787
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from fdaba61ef8a268d4136d0a113d153f7a89eb9984 before 5cb300dcdd27e6a351ac02541e0231261c775852; from fdaba61ef8a268d4136d0a113d153f7a89eb9984 before 000c9ee43928f2ce68a156dd40bab7616256f4dd; from fdaba61ef8a268d4136d0a113d153f7a89eb9984 before 9cc7f0018609f75a349e42e3aebc3b0e905ba775; from fdaba61ef8a268d4136d0a113d153f7a89eb9984 before b5741e4b9ef3567613b2351384f91d3f16e59986; from fdaba61ef8a268d4136d0a113d153f7a89eb9984 before e1dd09df30ba86716cb2ffab97dc35195c01eb8f; from fdaba61ef8a268d4136d0a113d153f7a89eb9984 before 3b4035ddbfc8e4521f85569998a7569668cccf51	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.13 before 5.15.179; from 5.16 before 6.1.131; from 6.2 before 6.6.83; from 6.7 before 6.12.19; from 6.13 before 6.13.7; 6.14; 6.14; 6.14; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/5cb300dcdd27e6a351ac02541e0231261c775852	patch
https://git.kernel.org/stable/c/000c9ee43928f2ce68a156dd40bab7616256f4dd	patch
https://git.kernel.org/stable/c/9cc7f0018609f75a349e42e3aebc3b0e905ba775	patch
https://git.kernel.org/stable/c/b5741e4b9ef3567613b2351384f91d3f16e59986	patch
https://git.kernel.org/stable/c/e1dd09df30ba86716cb2ffab97dc35195c01eb8f	patch
https://git.kernel.org/stable/c/3b4035ddbfc8e4521f85569998a7569668cccf51	patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.