{"id":"DEBIAN-CVE-2025-68199","details":"In the Linux kernel, the following vulnerability has been resolved:  codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext  When alloc_slab_obj_exts() fails and then later succeeds in allocating a slab extension vector, it calls handle_failed_objexts_alloc() to mark all objects in the vector as empty.  As a result all objects in this slab (slabA) will have their extensions set to CODETAG_EMPTY.  Later on if this slabA is used to allocate a slabobj_ext vector for another slab (slabB), we end up with the slabB-\u003eobj_exts pointing to a slabobj_ext vector that itself has a non-NULL slabobj_ext equal to CODETAG_EMPTY.  When slabB gets freed, free_slab_obj_exts() is called to free slabB-\u003eobj_exts vector.    free_slab_obj_exts() calls mark_objexts_empty(slabB-\u003eobj_exts) which will generate a warning because it expects slabobj_ext vectors to have a NULL obj_ext, not CODETAG_EMPTY.  Modify mark_objexts_empty() to skip the warning and setting the obj_ext value if it's already set to CODETAG_EMPTY.   To quickly detect this WARN, I modified the code from WARN_ON(slab_exts[offs].ref.ct) to BUG_ON(slab_exts[offs].ref.ct == 1);  We then obtained this message:  [21630.898561] ------------[ cut here ]------------ [21630.898596] kernel BUG at mm/slub.c:2050! [21630.898611] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [21630.900372] Modules linked in: squashfs isofs vfio_iommu_type1  vhost_vsock vfio vhost_net vmw_vsock_virtio_transport_common vhost tap  vhost_iotlb iommufd vsock binfmt_misc nfsv3 nfs_acl nfs lockd grace  netfs tls rds dns_resolver tun brd overlay ntfs3 exfat btrfs  blake2b_generic xor xor_neon raid6_pq loop sctp ip6_udp_tunnel  udp_tunnel nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib  nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct  nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4  nf_tables rfkill ip_set sunrpc vfat fat joydev sg sch_fq_codel nfnetlink  virtio_gpu sr_mod cdrom drm_client_lib virtio_dma_buf drm_shmem_helper  drm_kms_helper drm ghash_ce backlight virtio_net virtio_blk virtio_scsi  net_failover virtio_console failover virtio_mmio dm_mirror  dm_region_hash dm_log dm_multipath dm_mod fuse i2c_dev virtio_pci  virtio_pci_legacy_dev virtio_pci_modern_dev virtio virtio_ring autofs4  aes_neon_bs aes_ce_blk [last unloaded: hwpoison_inject] [21630.909177] CPU: 3 UID: 0 PID: 3787 Comm: kylin-process-m Kdump:  loaded Tainted: G        W           6.18.0-rc1+ #74 PREEMPT(voluntary) [21630.910495] Tainted: [W]=WARN [21630.910867] Hardware name: QEMU KVM Virtual Machine, BIOS unknown  2/2/2022 [21630.911625] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS  BTYPE=--) [21630.912392] pc : __free_slab+0x228/0x250 [21630.912868] lr : __free_slab+0x18c/0x250[21630.913334] sp :  ffff8000a02f73e0 [21630.913830] x29: ffff8000a02f73e0 x28: fffffdffc43fc800 x27:  ffff0000c0011c40 [21630.914677] x26: ffff0000c000cac0 x25: ffff00010fe5e5f0 x24:  ffff000102199b40 [21630.915469] x23: 0000000000000003 x22: 0000000000000003 x21:  ffff0000c0011c40 [21630.916259] x20: fffffdffc4086600 x19: fffffdffc43fc800 x18:  0000000000000000 [21630.917048] x17: 0000000000000000 x16: 0000000000000000 x15:  0000000000000000 [21630.917837] x14: 0000000000000000 x13: 0000000000000000 x12:  ffff70001405ee66 [21630.918640] x11: 1ffff0001405ee65 x10: ffff70001405ee65 x9 :  ffff800080a295dc [21630.919442] x8 : ffff8000a02f7330 x7 : 0000000000000000 x6 :  0000000000003000 [21630.920232] x5 : 0000000024924925 x4 : 0000000000000001 x3 :  0000000000000007 [21630.921021] x2 : 0000000000001b40 x1 : 000000000000001f x0 :  0000000000000001 [21630.921810] Call trace: [21630.922130]  __free_slab+0x228/0x250 (P) [21630.922669]  free_slab+0x38/0x118 [21630.923079]  free_to_partial_list+0x1d4/0x340 [21630.923591]  __slab_free+0x24c/0x348 [21630.924024]  ___cache_free+0xf0/0x110 [21630.924468]  qlist_free_all+0x78/0x130 [21630.924922]  kasan_quarantine_reduce+0x11 ---truncated---","modified":"2026-08-27T22:49:00.092342091Z","published":"2025-12-16T14:15:52.707Z","upstream":["CVE-2025-68199"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-68199"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.63-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1~bpo12+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-68199.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.9-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.17.8-1~bpo13+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-68199.json"}}],"schema_version":"1.9.0"}