CVE-2025-39902

mm/slub: avoid accessing metadata when pointer is invalid in object_err()

MEDIUM
5.5
CVSS Score
Published: October 1, 2025 at 07:42 AM UTC
Updated: October 19, 2026 at 09:10 PM UTC
2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: mm/slub: avoid accessing metadata when pointer is invalid in object_err() object_err() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However, if the pointer is invalid, attempting to access object metadata can lead to a crash since it does not point to a valid object. One known path to the crash is when alloc_consistency_checks() determines the pointer to the allocated object is invalid because of a freelist corruption, and calls object_err() to report it. The debug code should report and handle the corruption gracefully and not crash in the process. In case the pointer is NULL or check_valid_pointer() returns false for the pointer, only print the pointer value and skip accessing metadata.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

2.6.22 ≤ v < 5.4.2995.11 ≤ v < 5.15.1925.16 ≤ v < 6.1.1515.5 ≤ v < 5.10.2436.13 ≤ v < 6.16.66.2 ≤ v < 6.6.1056.7 ≤ v < 6.12.466.176.17 rc16.17 rc26.17 rc36.17 rc481819f0fc8285a2a5a921c019e3e3d7b6169d225
Vendor states this is fixed in 0ef7058b4dc6fcef622ac23b45225db57f17b83f (fixed)
Vendor states this is fixed in 1f0797f17927b5cad0fb7eced422f9a7c30a3191 (fixed)
Vendor states this is fixed in 3baa1da473e6e50281324ff1d332d1a07a3bb02e (fixed)
Vendor states this is fixed in 7e287256904ee796c9477e3ec92b07f236481ef3 (fixed)
Vendor states this is fixed in 872f2c34ff232af1e65ad2df86d61163c8ffad42 (fixed)
Vendor states this is fixed in b4efccec8d06ceb10a7d34d7b1c449c569d53770 (fixed)
Vendor states this is fixed in dda6ec365ab04067adae40ef17015db447e90736 (fixed)
Vendor states this is fixed in f66012909e7bf383fcdc5850709ed5716073fdc4 (fixed)
Vendor states this is fixed in 2.6.22 (unaffected)
Vendor states this is fixed in 5.10.243 (unaffected)
Vendor states this is fixed in 5.15.192 (unaffected)
Vendor states this is fixed in 5.4.299 (unaffected)
Vendor states this is fixed in 6.1.151 (unaffected)
Vendor states this is fixed in 6.12.46 (unaffected)
Vendor states this is fixed in 6.16.6 (unaffected)
Vendor states this is fixed in 6.17 (unaffected)
Vendor states this is fixed in 6.6.105 (unaffected)

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card