CVE-2025-37774

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

slab: ensure slab->obj_exts is clear in a newly allocated slab page

ktest recently reported crashes while running several buffered io tests

with __alloc_tagging_slab_alloc_hook() at the top of the crash call stack.

The signature indicates an invalid address dereference with low bits of

slab->obj_exts being set. The bits were outside of the range used by

page_memcg_data_flags and objext_flags and hence were not masked out

by slab_obj_exts() when obtaining the pointer stored in slab->obj_exts.

The typical crash log looks like this:

00510 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010

00510 Mem abort info:

00510 ESR = 0x0000000096000045

00510 EC = 0x25: DABT (current EL), IL = 32 bits

00510 SET = 0, FnV = 0

00510 EA = 0, S1PTW = 0

00510 FSC = 0x05: level 1 translation fault

00510 Data abort info:

00510 ISV = 0, ISS = 0x00000045, ISS2 = 0x00000000

00510 CM = 0, WnR = 1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References