In the Linux kernel, the following vulnerability has been resolved:
mm, slab: clean up slab->obj_exts always
When memory allocation profiling is disabled at runtime or due to an error, shutdownmemprofiling() is called: slab->objexts which previously allocated remains. It won't be cleared by unaccountslab() because of memallocprofilingenabled() not true. It's incorrect, slab->objexts should always be cleaned up in unaccount_slab() to avoid following error:
[...]BUG: Bad page state in process... .. [...]page dumped because: page still charged to cgroup
[andriy.shevchenko@linux.intel.com: fold needslabobj_ext() into its only user]
[
{
"id": "CVE-2025-37908-33be2c10",
"signature_version": "v1",
"digest": {
"length": 212.0,
"function_hash": "97957807675420222415176574214009600296"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dab2a13059a475b6392550f882276e170fe2fcff",
"target": {
"file": "mm/slub.c",
"function": "unaccount_slab"
}
},
{
"id": "CVE-2025-37908-87a62432",
"signature_version": "v1",
"digest": {
"length": 91.0,
"function_hash": "277770511785238568655172797624678597531"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dab2a13059a475b6392550f882276e170fe2fcff",
"target": {
"file": "mm/slub.c",
"function": "need_slab_obj_ext"
}
},
{
"id": "CVE-2025-37908-ebbcb861",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"25085993447877194172150306617016508930",
"302592728714989924989699507731221854153",
"207501043407323789638505801764642905896",
"243556991945151907223993900287092521670",
"52350011466230525844812470952204485935",
"330697245568497291816041353200639096853",
"216015766303107272292418592140281131205",
"18734412032540691480263739077298137966",
"71043506980396588059736250538497414668",
"193639609648817964709719558348579996167",
"197264156541398746490409540779393153245",
"112145762305462248920431394911841362532",
"114702521198944845156753371973513442267",
"13983307218782605643106368001404847137",
"97481001744166081268054017911850852741",
"183456735456342226214523369067049354387",
"290258482191514344278387609569585404472",
"5250165445209838260032418178670100076",
"268065576358025030533217043738705094290",
"113498360046092468991842248542369441481",
"33010271208747306102198800230979637368",
"88883970491383365114176361488756968804",
"194998013827764752033480490614849405501",
"137431715392866211519967607695686893111",
"304125299047321046669383514477131922742"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dab2a13059a475b6392550f882276e170fe2fcff",
"target": {
"file": "mm/slub.c"
}
}
]