CVE-2025-40348

Vulnerability

Overview

In the Linux kernel, a race condition exists in the alloc_slab_obj_exts allocation within the slab allocator. When two threads concurrently call alloc_slab_obj_exts(), one thread may fail to allocate the object extension vector and incorrectly overwrite the valid pointer set by the other thread with the OBJEXTS_ALLOC_FAIL sentinel. This race can lead to a NULL pointer dereference when the thread that lost the race later attempts to use the corrupted pointer.

Exploitation

An attacker would need to trigger concurrent execution of alloc_slab_obj_exts() from multiple threads simultaneously, which is possible in multi-threaded or multi-process workloads. No special privileges are required beyond the ability to invoke memory allocation operations that trigger slab extension allocation. The race window is small but exploitable under the right timing conditions.

Impact

A successful exploit results in a NULL pointer dereference, causing a kernel crash (denial of service). In some configurations, this could potentially be leveraged for privilege escalation if the attacker can control the corrupted pointer, though the primary impact is system instability.

Mitigation

The fix uses cmpxchg() to atomically update slab->obj_exts, preventing the race condition. The patch has been merged into the Linux kernel stable tree [1]. Users should apply the latest kernel updates from their distribution to remediate this vulnerability.