CVE-2025-40348

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts

If two competing threads enter alloc_slab_obj_exts() and one of them

fails to allocate the object extension vector, it might override the

valid slab->obj_exts allocated by the other thread with

OBJEXTS_ALLOC_FAIL. This will cause the thread that lost this race and

expects a valid pointer to dereference a NULL pointer later on.

Update slab->obj_exts atomically using cmpxchg() to avoid

slab->obj_exts overrides by racing threads.

Thanks for Vlastimil and Suren's help with debugging.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References