diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
index 5ed4a00..af3576d 100644
--- a/meta/recipes-kernel/linux/cve-exclusion.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion.inc
@@ -199,3 +199,10 @@ CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3"
 # https://ubuntu.com/security/CVE-2019-14899
 CVE_STATUS[CVE-2019-14899] = "unpatched: consequence of the default weak \
 host model, no upstream kernel fix, mitigated by firewall configuration"
+
+# Timing side channel inherent to KSM page deduplication. Reachable only
+# when ksmd is started (/sys/kernel/mm/ksm/run defaults to 0) and the
+# workload opts in via MADV_MERGEABLE or prctl(PR_SET_MEMORY_MERGE).
+# https://security-tracker.debian.org/tracker/CVE-2021-3714
+CVE_STATUS[CVE-2021-3714] = "unpatched: timing side channel inherent to \
+KSM page deduplication, only reachable when KSM is enabled and opted into"