diff mbox series

[v4,2/8] cve-exclusions: set status for CVE-2021-3714

Message ID 20260824042123.1456876-3-junjie.cao@linux.dev
State New
Headers show
Series cve-exclusions: triage eight kernel CVEs lacking upstream fix data | expand

Commit Message

Junjie Cao Aug. 24, 2026, 4:21 a.m. UTC 
KSM merges identical anonymous pages across processes. An attacker who
can place chosen page-sized content in a victim's memory can detect the
merge through the timing of the resulting copy-on-write fault, and so
leak memory contents.

There is no upstream fix; removing the side channel means removing
deduplication. Distribution trackers describe it the same way - Debian
marks src:linux unfixed with "Inherent design limitation, can be
avoided by not using KSM", Red Hat closed its bug WONTFIX, and Ubuntu
records no upstream fix as of 2024-06-17:

  https://security-tracker.debian.org/tracker/CVE-2021-3714
  https://bugzilla.redhat.com/show_bug.cgi?id=1931327
  https://ubuntu.com/security/CVE-2021-3714

CC: Paul Barker <paul@pbarker.dev>
AI-Generated: Uses Claude (claude-opus-5)
Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
---
v4:
- use the review's comment and status wording; drop the KSM runtime
  opt-in paragraph

v3: https://lore.kernel.org/openembedded-core/20260812072842.1176341-1-junjie.cao@linux.dev/

 meta/recipes-kernel/linux/cve-exclusion.inc | 9 +++++++++
 1 file changed, 9 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
index b2eb15d0..36643ccc 100644
--- a/meta/recipes-kernel/linux/cve-exclusion.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion.inc
@@ -197,3 +197,12 @@  CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3"
 # https://ubuntu.com/security/CVE-2019-14899
 CVE_STATUS[CVE-2019-14899] = "unpatched: Consequence of the default weak host \
 model, no upstream fix"
+
+# Triaged August 2026 - no upstream fix, Debian says "Inherent design
+# limitation, can be avoided by not using KSM", Red Hat closed their bug as
+# WONTFIX.
+# https://security-tracker.debian.org/tracker/CVE-2021-3714
+# https://bugzilla.redhat.com/show_bug.cgi?id=1931327
+# https://ubuntu.com/security/CVE-2021-3714
+CVE_STATUS[CVE-2021-3714] = "unpatched: Timing side channel inherent to Kernel \
+Same-page Merging (KSM) page deduplication"