{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-37908","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T04:51:23.966Z","datePublished":"2025-05-20T15:21:41.121Z","dateUpdated":"2026-08-05T11:58:14.367Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:58:14.367Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm, slab: clean up slab->obj_exts always\n\nWhen memory allocation profiling is disabled at runtime or due to an\nerror, shutdown_mem_profiling() is called: slab->obj_exts which\npreviously allocated remains.\nIt won't be cleared by unaccount_slab() because of\nmem_alloc_profiling_enabled() not true. It's incorrect, slab->obj_exts\nshould always be cleaned up in unaccount_slab() to avoid following error:\n\n[...]BUG: Bad page state in process...\n..\n[...]page dumped because: page still charged to cgroup\n\n[andriy.shevchenko@linux.intel.com: fold need_slab_obj_ext() into its only user]"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is `unaccount_slab()` in core mm/slub, reached whenever a slab page is destroyed; an attacker must be on the system to drive slab allocation/destruction churn (file/socket/dentry creation plus memory pressure). There is no network protocol handler involved, so this is local.\nAC:L - Once memory allocation profiling has been shut down (sysctl toggle, or automatically via `shutdown_mem_profiling()` on a module-load tag-budget failure), every subsequent slab destruction deterministically leaks `obj_exts` and leaves a stale `page->memcg_data` — no race, no timing, and the attacker reliably forces slab teardown at will.\nPR:L - No privileges are needed for the trigger itself — any unprivileged local user can allocate and free enough objects to force `__free_slab()` → `unaccount_slab()` repeatedly. The precondition of profiling being disabled is pre-existing system state, not something the attacker must have rights to set.\nUI:N - The leak and the stale `memcg_data` are produced entirely by the attacker's own allocation/free activity in kernel context. No victim action of any kind is required.\nS:U - The leaked vector, the corrupted `page->memcg_data`, and any resulting corruption all stay within the kernel's own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The `bad_page()` report emits the raw `slabobj_ext` heap pointer (`memcg:%lx`) plus a full hex dump of `struct page` into the kernel log, and when page checks are off the stale pointer is type-confused as a `struct mem_cgroup *` by `__folio_memcg()`, giving wild-pointer reads inside memcg accounting — memory corruption leverageable for disclosure.\nI:H - Slab folios re-enter the buddy allocator carrying a bogus `struct mem_cgroup *`, and `split_page_memcg()` propagates it to tail pages and calls `css_get_many()` through it, writing via a percpu refcount pointer read out of the attacker-groomable `slabobj_ext` array — a type-confusion write primitive.\nA:H - Every destroyed slab leaks its `obj_exts` vector, and with page sanity checks enabled `free_pages_prepare()` returns false so the entire slab folio is permanently leaked as well while the kernel is tainted — sustained slab churn drives unbounded memory exhaustion and OOM, on top of the crashes from the stale-pointer/`VM_BUG_ON_FOLIO` paths."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/slub.c"],"versions":[{"version":"21c690a349baab895dc68ab70d291e1598d7109d","lessThan":"dab2a13059a475b6392550f882276e170fe2fcff","status":"affected","versionType":"git"},{"version":"21c690a349baab895dc68ab70d291e1598d7109d","lessThan":"01db0e1a48345aa1937f3bdfc7c7108d03ebcf7e","status":"affected","versionType":"git"},{"version":"21c690a349baab895dc68ab70d291e1598d7109d","lessThan":"be8250786ca94952a19ce87f98ad9906448bc9ef","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/slub.c"],"versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","status":"unaffected","versionType":"semver"},{"version":"6.12.28","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.14.6","lessThanOrEqual":"6.14.*","status":"unaffected","versionType":"semver"},{"version":"6.15","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.12.28"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.14.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.15"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/dab2a13059a475b6392550f882276e170fe2fcff"},{"url":"https://git.kernel.org/stable/c/01db0e1a48345aa1937f3bdfc7c7108d03ebcf7e"},{"url":"https://git.kernel.org/stable/c/be8250786ca94952a19ce87f98ad9906448bc9ef"}],"title":"mm, slab: clean up slab->obj_exts always","x_generator":{"engine":"bippy-1.2.0"}}}}