CVE-2025-40348 Details
Description
In the Linux kernel, the following vulnerability has been resolved: slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts If two competing threads enter alloc_slab_obj_exts() and one of them fails to allocate the object extension vector, it might override the valid slab->obj_exts allocated by the other thread with OBJEXTS_ALLOC_FAIL. This will cause the thread that lost this race and expects a valid pointer to dereference a NULL pointer later on. Update slab->obj_exts atomically using cmpxchg() to avoid slab->obj_exts overrides by racing threads. Thanks for Vlastimil and Suren's help with debugging.
A race condition vulnerability has been identified in the Linux kernel's slab allocator. This issue arises in the 'alloc_slab_obj_exts()' function, where two competing threads may interfere with each other. If one thread fails to allocate the object extension vector, it can mistakenly overwrite a valid extension vector from another thread with a failure indicator. This interference can lead to a null pointer dereference in the thread that lost the race. The vulnerability is present in the Linux kernel stable tree.
The vulnerability has been addressed by updating the object extension pointer in a thread-safe manner, using an atomic compare-and-swap operation. Users should upgrade to the latest version of the Linux kernel stable tree where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 16, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/6ed8bfd24ce1cb31742b09a3eb557cd008533eec | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/7c34feda6a9a203c9744281f1b6671b7dad2012d | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/c7af5300d78460fc5037ddc77113ba3dbfe77dc0 | kernel.org | Source CodeVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Linux kernel | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Dec 16, 2025 | New CVE Received | kernel.org |