Executive brief
A vulnerability in the Linux kernel's memory management system could cause a system crash or potentially expose sensitive information. The issue occurs when the kernel attempts to log details about a memory error but inadvertently accesses invalid memory locations itself. This could be exploited by a local user to disrupt system operations or gain unauthorized access to data.
Technical details
The vulnerability is a NULL pointer dereference (CWE-476) located in mm/slub.c within the object_err() function. When the kernel detects memory corruption via alloc_consistency_checks(), it calls object_err() to report debugging details. However, if the object pointer itself is invalid or NULL, object_err() would attempt to access its metadata (such as redzones or freelist pointers), leading to a kernel oops/crash. A local attacker with low privileges can trigger this condition to cause a Denial of Service (DoS) or potentially leak kernel memory information. The fix introduces a check using check_valid_pointer() to ensure the pointer is valid before attempting to access its metadata.
Affected products
- Linux Linux Kernel 2.6.22 to 6.1.151
Timeline
- 2025-09-09: patched: Fix committed to stable kernel trees.
- 2025-10-01: disclosed: CVE published.
References
- https://git.kernel.org/stable/c/0ef7058b4dc6fcef622ac23b45225db57f17b83f
- https://git.kernel.org/stable/c/1f0797f17927b5cad0fb7eced422f9a7c30a3191
- https://git.kernel.org/stable/c/3baa1da473e6e50281324ff1d332d1a07a3bb02e
- https://git.kernel.org/stable/c/7e287256904ee796c9477e3ec92b07f236481ef3
- https://git.kernel.org/stable/c/872f2c34ff232af1e65ad2df86d61163c8ffad42
- https://git.kernel.org/stable/c/b4efccec8d06ceb10a7d34d7b1c449c569d53770
- https://git.kernel.org/stable/c/dda6ec365ab04067adae40ef17015db447e90736