CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err()
In the Linux kernel, the following vulnerability has been resolved:
mm/slub: avoid accessing metadata when pointer is invalid in objecterr()
objecterr() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However, if the pointer is invalid, attempting to access object metadata can lead to a crash since it does not point to a valid object.
One known path to the crash is when allocconsistencychecks() determines the pointer to the allocated object is invalid because of a freelist corruption, and calls objecterr() to report it. The debug code should report and handle the corruption gracefully and not crash in the process.
In case the pointer is NULL or checkvalidpointer() returns false for the pointer, only print the pointer value and skip accessing metadata.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39902?
CVE-2025-39902 is considered a moderate severity vulnerability due to potential information disclosure risks.
How do I fix CVE-2025-39902?
To remediate CVE-2025-39902, update to the latest patched version of the Linux kernel as provided by your distribution.
What systems are affected by CVE-2025-39902?
CVE-2025-39902 affects all versions of the Linux kernel that include the vulnerable mm/slub implementation.
What does CVE-2025-39902 exploit?
CVE-2025-39902 exploits vulnerabilities in the object_err() function to access invalid metadata pointers.
Is there a workaround for CVE-2025-39902?
There are no specific workarounds for CVE-2025-39902; upgrading to a secure kernel version is recommended.