CVE-2025-71110

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/slub: reset KASAN tag in defer_free() before accessing freed memory

When CONFIG_SLUB_TINY is enabled, kfree_nolock() calls kasan_slab_free()

before defer_free(). On ARM64 with MTE (Memory Tagging Extension),

kasan_slab_free() poisons the memory and changes the tag from the

original (e.g., 0xf3) to a poison tag (0xfe).

When defer_free() then tries to write to the freed object to build the

deferred free list via llist_add(), the pointer still has the old tag,

causing a tag mismatch and triggering a KASAN use-after-free report:

BUG: KASAN: slab-use-after-free in defer_free+0x3c/0xbc mm/slub.c:6537

Write at addr f3f000000854f020 by task kworker/u8:6/983

Pointer tag: [f3], memory tag: [fe]

Fix this by calling kasan_reset_tag() before accessing the freed memory.

This is safe because defer_free() is part of the allocator itself and is

expected to manipulate freed memory for bookkeeping purposes.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References