---
id: CVE-2025-39902
title: 'mm/slub: avoid accessing metadata when pointer is invalid in object_err()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mm/slub: avoid accessing metadata when pointer is invalid in object_err()

  object_err() reports details of an object for further debugging, such as
  the freelist pointer…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 <
    872f2c34ff232af1e65ad2df86d61163c8ffad42
  - >-
    Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 <
    f66012909e7bf383fcdc5850709ed5716073fdc4
  - >-
    Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 <
    7e287256904ee796c9477e3ec92b07f236481ef3
  - >-
    Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 <
    1f0797f17927b5cad0fb7eced422f9a7c30a3191
  - >-
    Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 <
    0ef7058b4dc6fcef622ac23b45225db57f17b83f
  - >-
    Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 <
    dda6ec365ab04067adae40ef17015db447e90736
  - >-
    Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 <
    3baa1da473e6e50281324ff1d332d1a07a3bb02e
  - >-
    Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 <
    b4efccec8d06ceb10a7d34d7b1c449c569d53770
  - Linux 2.6.22
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T21:54:38.930497Z'
published: '2025-10-01'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:02:32.999Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39902'
references:
  - url: 'https://git.kernel.org/stable/c/872f2c34ff232af1e65ad2df86d61163c8ffad42'
  - url: 'https://git.kernel.org/stable/c/f66012909e7bf383fcdc5850709ed5716073fdc4'
  - url: 'https://git.kernel.org/stable/c/7e287256904ee796c9477e3ec92b07f236481ef3'
  - url: 'https://git.kernel.org/stable/c/1f0797f17927b5cad0fb7eced422f9a7c30a3191'
  - url: 'https://git.kernel.org/stable/c/0ef7058b4dc6fcef622ac23b45225db57f17b83f'
  - url: 'https://git.kernel.org/stable/c/dda6ec365ab04067adae40ef17015db447e90736'
  - url: 'https://git.kernel.org/stable/c/3baa1da473e6e50281324ff1d332d1a07a3bb02e'
  - url: 'https://git.kernel.org/stable/c/b4efccec8d06ceb10a7d34d7b1c449c569d53770'
tags:
  - cve.org
epss: 0.00167
epssPercentile: 0.05917
ingestedAt: '2026-10-15T22:48:25.529Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mm/slub: avoid accessing metadata when pointer is invalid in object_err()

object_err() reports details of an object for further debugging, such as
the freelist pointer, redzone, etc. However, if the pointer is invalid,
attempting to access object metadata can lead to a crash since it does
not point to a valid object.

One known path to the crash is when alloc_consistency_checks()
determines the pointer to the allocated object is invalid because of a
freelist corruption, and calls object_err() to report it. The debug code
should report and handle the corruption gracefully and not crash in the
process.

In case the pointer is NULL or check_valid_pointer() returns false for
the pointer, only print the pointer value and skip accessing metadata.

## Affected

- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < 872f2c34ff232af1e65ad2df86d61163c8ffad42`
- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < f66012909e7bf383fcdc5850709ed5716073fdc4`
- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < 7e287256904ee796c9477e3ec92b07f236481ef3`
- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < 1f0797f17927b5cad0fb7eced422f9a7c30a3191`
- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < 0ef7058b4dc6fcef622ac23b45225db57f17b83f`
- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < dda6ec365ab04067adae40ef17015db447e90736`
- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < 3baa1da473e6e50281324ff1d332d1a07a3bb02e`
- `Linux >= 81819f0fc8285a2a5a921c019e3e3d7b6169d225 < b4efccec8d06ceb10a7d34d7b1c449c569d53770`
- `Linux 2.6.22`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.