{"id":"CVE-2025-39902","title":"mm/slub: avoid accessing metadata when pointer is invalid in object_err()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slub: avoid accessing metadata when pointer is invalid in object_err()\n\nobject_err() reports details of an object for further debugging, such as\nthe freelist pointer…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < 872f2c34ff232af1e65ad2df86d61163c8ffad42","Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < f66012909e7bf383fcdc5850709ed5716073fdc4","Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < 7e287256904ee796c9477e3ec92b07f236481ef3","Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < 1f0797f17927b5cad0fb7eced422f9a7c30a3191","Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < 0ef7058b4dc6fcef622ac23b45225db57f17b83f","Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < dda6ec365ab04067adae40ef17015db447e90736","Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < 3baa1da473e6e50281324ff1d332d1a07a3bb02e","Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < b4efccec8d06ceb10a7d34d7b1c449c569d53770","Linux 2.6.22"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T21:54:38.930497Z"},"published":"2025-10-01","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:02:32.999Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39902","references":[{"url":"https://git.kernel.org/stable/c/872f2c34ff232af1e65ad2df86d61163c8ffad42"},{"url":"https://git.kernel.org/stable/c/f66012909e7bf383fcdc5850709ed5716073fdc4"},{"url":"https://git.kernel.org/stable/c/7e287256904ee796c9477e3ec92b07f236481ef3"},{"url":"https://git.kernel.org/stable/c/1f0797f17927b5cad0fb7eced422f9a7c30a3191"},{"url":"https://git.kernel.org/stable/c/0ef7058b4dc6fcef622ac23b45225db57f17b83f"},{"url":"https://git.kernel.org/stable/c/dda6ec365ab04067adae40ef17015db447e90736"},{"url":"https://git.kernel.org/stable/c/3baa1da473e6e50281324ff1d332d1a07a3bb02e"},{"url":"https://git.kernel.org/stable/c/b4efccec8d06ceb10a7d34d7b1c449c569d53770"}],"tags":["cve.org"],"epss":0.00167,"epssPercentile":0.05917,"ingestedAt":"2026-10-15T22:48:25.529Z","slug":"CVE-2025-39902","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/slub: avoid accessing metadata when pointer is invalid in object_err()\n\nobject_err() reports details of an object for further debugging, such as\nthe freelist pointer, redzone, etc. However, if the pointer is invalid,\nattempting to access object metadata can lead to a crash since it does\nnot point to a valid object.\n\nOne known path to the crash is when alloc_consistency_checks()\ndetermines the pointer to the allocated object is invalid because of a\nfreelist corruption, and calls object_err() to report it. The debug code\nshould report and handle the corruption gracefully and not crash in the\nprocess.\n\nIn case the pointer is NULL or check_valid_pointer() returns false for\nthe pointer, only print the pointer value and skip accessing metadata.\n\n## Affected\n\n- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < 872f2c34ff232af1e65ad2df86d61163c8ffad42`\n- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < f66012909e7bf383fcdc5850709ed5716073fdc4`\n- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < 7e287256904ee796c9477e3ec92b07f236481ef3`\n- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < 1f0797f17927b5cad0fb7eced422f9a7c30a3191`\n- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < 0ef7058b4dc6fcef622ac23b45225db57f17b83f`\n- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < dda6ec365ab04067adae40ef17015db447e90736`\n- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < 3baa1da473e6e50281324ff1d332d1a07a3bb02e`\n- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < b4efccec8d06ceb10a7d34d7b1c449c569d53770`\n- `Linux 2.6.22`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}