CVE-2025-40348

A race condition was found in the Linux kernel's slab allocator. When two threads concurrently call alloc_slab_obj_exts() and one fails allocation, it may overwrite the other's valid obj_exts pointer with OBJEXTS_ALLOC_FAIL. The winning thread later dereferences this as a valid pointer, causing a null pointer dereference.

This race exists in core memory allocation code but requires CONFIG_SLUB_DEBUG or CONFIG_MEMCG_KMEM enabled with specific concurrent allocation patterns. The fix uses cmpxchg for atomic updates.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.