CVE-2025-38517

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users()

alloc_tag_top_users() attempts to lock alloc_tag_cttype->mod_lock even

when the alloc_tag_cttype is not allocated because:

1) alloc tagging is disabled because mem profiling is disabled

(!alloc_tag_cttype)

2) alloc tagging is enabled, but not yet initialized (!alloc_tag_cttype)

3) alloc tagging is enabled, but failed initialization

(!alloc_tag_cttype or IS_ERR(alloc_tag_cttype))

In all cases, alloc_tag_cttype is not allocated, and therefore

alloc_tag_top_users() should not attempt to acquire the semaphore.

This leads to a crash on memory allocation failure by attempting to

acquire a non-existent semaphore:

Oops: general protection fault, probably for non-canonical address 0xdffffc000000001b: 0000 [#3] SMP KASAN NOPTI

KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df]

CPU: 2 UID: 0 PID: 1 Comm: system

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References