CVE-2025-68199

Description

A flaw was identified in the Linux kernel’s SLUB memory allocator involving the handling of slab object extension vectors.When an extension vector allocation initially fails and later succeeds, the failure path marks all objects in the slab with a sentinel tag. If this slab is later reused for another object extension allocation, the pointer to the extension vector may include a sentinel value instead of a null, which is unexpected by the free path. During slab freeing, the mark_objexts_empty() helper will generate a warning or a kernel BUG due to incorrectly assuming a null extension rather than a sentinel value

Mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score5.8N/AN/A
Attack VectorLocalN/AN/A
Attack ComplexityHighN/AN/A
Privileges RequiredLowN/AN/A
User InteractionNoneN/AN/A
ScopeUnchangedN/AN/A
ConfidentialityLowN/AN/A
Integrity ImpactLowN/AN/A
Availability ImpactHighN/AN/A

Vector

Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Understanding the Weakness (CWE)

CWE-691

Other

Technical Impact: Alter Execution Logic

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.