CVE-2025-39902

MEDIUM EPSS 4.5%

Published Oct 1, 20259mo ago · Modified Jun 17, 20262w ago

5.5 CVSS 3.1

Medium

Published Oct 1, 2025 9mo ago

Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: mm/slub: avoid accessing metadata when pointer is invalid in object_err() object_err() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However, if the pointer is invalid, attempting to access object metadata can lead to a crash since it does not point to a valid object. One known path to the crash is when alloc_consistency_checks() determines the pointer to the allocated object is invalid because of a freelist corruption, and calls object_err() to report it. The debug code should report and handle the corruption gracefully and not crash in the process. In case the pointer is NULL or check_valid_pointer() returns false for the pointer, only print the pointer value and skip accessing metadata.

CVSS Details

Base Score

5.5

Exploitability

1.8

Impact

3.6

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

4.5% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-476 NULL Pointer Dereference Memory Safety

Affected Products 12

Vendor	Product	Version	Range
linux	linux_kernel	*	≥2.6.22 – <5.4.299
linux	linux_kernel	*	≥5.5 – <5.10.243
linux	linux_kernel	*	≥5.11 – <5.15.192
linux	linux_kernel	*	≥5.16 – <6.1.151
linux	linux_kernel	*	≥6.2 – <6.6.105
linux	linux_kernel	*	≥6.7 – <6.12.46
linux	linux_kernel	*	≥6.13 – <6.16.6
linux	linux_kernel	6.17	any
linux	linux_kernel	6.17	any
linux	linux_kernel	6.17	any
linux	linux_kernel	6.17	any
debian	debian_linux	11.0	any

References 10

git.kernel.org https://git.kernel.org/stable/c/0ef7058b4dc6fcef622ac23b45225db57f17b83f

Patch
git.kernel.org https://git.kernel.org/stable/c/1f0797f17927b5cad0fb7eced422f9a7c30a3191

Patch
git.kernel.org https://git.kernel.org/stable/c/3baa1da473e6e50281324ff1d332d1a07a3bb02e

Patch
git.kernel.org https://git.kernel.org/stable/c/7e287256904ee796c9477e3ec92b07f236481ef3

Patch
git.kernel.org https://git.kernel.org/stable/c/872f2c34ff232af1e65ad2df86d61163c8ffad42

Patch
git.kernel.org https://git.kernel.org/stable/c/b4efccec8d06ceb10a7d34d7b1c449c569d53770

Patch
git.kernel.org https://git.kernel.org/stable/c/dda6ec365ab04067adae40ef17015db447e90736

Patch
git.kernel.org https://git.kernel.org/stable/c/f66012909e7bf383fcdc5850709ed5716073fdc4

Patch
lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

Third Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

Third Party Advisory

Remediation

git.kernel.org https://git.kernel.org/stable/c/0ef7058b4dc6fcef622ac23b45225db57f17b83f

Patch
git.kernel.org https://git.kernel.org/stable/c/1f0797f17927b5cad0fb7eced422f9a7c30a3191

Patch
git.kernel.org https://git.kernel.org/stable/c/3baa1da473e6e50281324ff1d332d1a07a3bb02e

Patch
git.kernel.org https://git.kernel.org/stable/c/7e287256904ee796c9477e3ec92b07f236481ef3

Patch
git.kernel.org https://git.kernel.org/stable/c/872f2c34ff232af1e65ad2df86d61163c8ffad42

Patch
git.kernel.org https://git.kernel.org/stable/c/b4efccec8d06ceb10a7d34d7b1c449c569d53770

Patch
git.kernel.org https://git.kernel.org/stable/c/dda6ec365ab04067adae40ef17015db447e90736

Patch
git.kernel.org https://git.kernel.org/stable/c/f66012909e7bf383fcdc5850709ed5716073fdc4

Patch