Bug 2422722 (CVE-2025-68199)
| Summary: | CVE-2025-68199 kernel: codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was identified in the Linux kernel’s SLUB memory allocator involving the handling of slab object extension vectors.When an extension vector allocation initially fails and later succeeds, the failure path marks all objects in the slab with a sentinel tag. If this slab is later reused for another object extension allocation, the pointer to the extension vector may include a sentinel value instead of a null, which is unexpected by the free path. During slab freeing, the mark_objexts_empty() helper will generate a warning or a kernel BUG due to incorrectly assuming a null extension rather than a sentinel value
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2025-12-16 14:06:23 UTC
|