LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err()

In the Linux kernel, the following vulnerability has been resolved: mm/slub: avoid accessing metadata when pointer is invalid in object_err() object_err() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However, if the pointer is invalid, attempting to access object metadata can lead to a crash since it does not point to a valid object. One known path to the crash is when alloc_consistency_checks() determines the pointer to the allocated object is invalid because of a freelist corruption, and calls object_err() to report it. The debug code should report and handle the corruption gracefully and not crash in the process. In case the pointer is NULL or check_valid_pointer() returns false for the pointer, only print the pointer value and skip accessing metadata.

HighCVSS 7.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel error-reporting routine can crash while examining an invalid memory-management object pointer. This can disrupt affected systems and may expose sensitive data according to the supplied CVSS assessment. Exploitation requires local, low-privilege access; the issue is not presented as directly remotely exploitable.

Executive priority

Treat this as a high-priority kernel maintenance issue, especially on shared systems with untrusted local users. It does not warrant the urgency of a confirmed remotely exploited flaw based on current evidence, but delayed patching preserves a kernel-crash and possible confidentiality risk.

Technical view

When SLUB allocation consistency checks detect an invalid object pointer, object_err() may dereference that pointer while collecting metadata, causing a kernel crash. The correction checks for NULL or an invalid pointer, reports only its value, and skips metadata access. The supplied CVSS 3.1 score is 7.1, with high confidentiality and availability impact.

Likely exposure

Exposure is limited to Linux systems running affected kernel builds where a local low-privilege actor can reach the vulnerable path. The supplied version data spans multiple kernel branches but is insufficiently structured to determine every vulnerable package release. Confirm status against the system vendor's advisory and kernel build.

Exploitation context

The CVSS vector indicates local access, low complexity, low privileges, and no user interaction. The supplied description identifies corrupted freelist handling as one crash path. CISA KEV status is false, and the sources provide no evidence of active exploitation or a public exploit.

Researcher notes

The documented defect is in diagnostic handling after an invalid pointer has already been detected. The description clearly supports a crash outcome; confidentiality impact appears in the CVSS vector but is not explained by the supplied technical narrative. No CWE is assigned. Exact vulnerable package boundaries require vendor-specific confirmation.

Mitigation direction

  • Install a vendor-supported kernel update that incorporates the applicable stable fix.
  • Review the listed Debian advisories when operating affected Debian releases.
  • Restrict unnecessary local accounts and privileged workload access until updates are deployed.
  • Follow distribution guidance if an updated kernel is not yet available.

Validation and detection

  • Inventory running kernel versions across Linux systems.
  • Compare each kernel package against its distribution's CVE advisory and fixed release.
  • Confirm the applicable stable-kernel correction is present in custom kernel trees.
  • Reboot updated systems and verify the corrected kernel is running.
  • Review kernel logs for SLUB corruption reports or unexpected crashes.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39902 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2025-39902Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux81819f0fc8285a2a5a921c019e3e3d7b6169d225, 81819f0fc8285a2a5a921c019e3e3d7b6169d225, 81819f0fc8285a2a5a921c019e3e3d7b6169d225, 81819f0fc8285a2a5a921c019e3e3d7b6169d225, 81819f0fc8285a2a5a921c019e3e3d7b6169d225, 81819f0fc8285a2a5a921c019e3e3d7b6169d225, 81819f0fc8285a2a5a921c019e3e3d7b6169d225, 81819f0fc8285a2a5a921c019e3e3d7b6169d225unaffected
LinuxLinux2.6.22, 0, 5.4.299, 5.10.243, 5.15.192, 6.1.151, 6.6.105, 6.12.46, 6.16.6, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.