SECUFOCUSNOW
Home›CVE index›CVE-2025-37908
Review reviewHigh

CVE-2025-37908

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: mm, slab: clean up slab->obj_exts always When memory allocation profiling is disabled at runtime or due to an error, shutdown_mem_profiling() is called: slab->obj_exts which previously allocated remains. It won't be cleared by unaccount_slab() because of mem_alloc_profiling_enabled() not true. It's incorrect, slab->obj_exts should always be cleaned up in unaccount_slab() to avoid following error: [...]BUG: Bad page state in process... .. [...]page dumped because: page still charged to cgroup [andriy.shevchenko@linux.intel.c...

CVSS
7.8
EPSS
0.17%
6.88% percentile
CISA KEV
Not listed
Published
2025.05.21
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.17%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: mm, slab: clean up slab->obj_exts always When memory allocation profiling is disabled at runtime or due to an error, shutdown_mem_profiling() is called: slab->obj_exts which previously allocated remains. It won't be cleared by unaccount_slab() because of mem_alloc_profiling_enabled() not true. It's incorrect, slab->obj_exts should always be cleaned up in unaccount_slab() to avoid following error: [...]BUG: Bad page state in process... .. [...]page dumped because: page still charged to cgroup [andriy.shevchenko@linux.intel.c...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 21c690a349baab895dc68ab70d291e1598d7109d < dab2a13059a475b6392550f882276e170fe2fcff, >= 21c690a349baab895dc68ab70d291e1598d7109d < 01db0e1a48345aa1937f3bdfc7c7108d03ebcf7e, >= 21c690a349baab895dc68ab70d291e1598d7109d < be8250786ca94952a19ce87f98ad9906448bc9ef, >= 6.10, >= 6.10 < 6.12.28, >= 6.13 < 6.14.6, 6.15
Fixed versions
6.12.28, 6.14.6

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-459