CVE-2025-68199

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext

When alloc_slab_obj_exts() fails and then later succeeds in allocating a

slab extension vector, it calls handle_failed_objexts_alloc() to mark all

objects in the vector as empty. As a result all objects in this slab

(slabA) will have their extensions set to CODETAG_EMPTY.

Later on if this slabA is used to allocate a slabobj_ext vector for

another slab (slabB), we end up with the slabB->obj_exts pointing to a

slabobj_ext vector that itself has a non-NULL slabobj_ext equal to

CODETAG_EMPTY. When slabB gets freed, free_slab_obj_exts() is called to

free slabB->obj_exts vector.

free_slab_obj_exts() calls mark_objexts_empty(slabB->obj_exts) which will

generate a warning because it expects slabobj_ext vectors to have a NULL

obj_ext, not CODETAG_EMPTY.

Modify mark_objexts_empty() to skip the warning and setting the obj_ext

value if it'

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References