diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
index aaba26fe..9012d328 100644
--- a/meta/recipes-kernel/linux/cve-exclusion.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion.inc
@@ -199,3 +199,10 @@ CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3"
 # https://www.openwall.com/lists/oss-security/2019/12/05/1
 CVE_STATUS[CVE-2019-14899] = "upstream-wontfix: consequence of the default weak \
 host model, no kernel fix exists or is planned, mitigated by firewall configuration"
+
+# Inherent to KSM deduplication, closed WONTFIX by Red Hat. Exposure needs
+# ksmd started at runtime (/sys/kernel/mm/ksm/run defaults to 0) and the
+# workload to opt in via MADV_MERGEABLE or prctl(PR_SET_MEMORY_MERGE).
+# https://bugzilla.redhat.com/show_bug.cgi?id=1931327
+CVE_STATUS[CVE-2021-3714] = "upstream-wontfix: inherent design limitation of \
+KSM page deduplication, closed WONTFIX by Red Hat, no upstream fix planned"