CVE-2025-40348: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40348 is a race condition vulnerability in the Linux kernel's slab memory allocator, specifically in the alloc_slab_obj_exts() function. When two competing threads simultaneously enter this function and one fails to allocate the object extension vector, it may overwrite a valid slab->obj_exts pointer set by the other thread with OBJEXTS_ALLOC_FAIL, leading to a NULL pointer dereference. The vulnerability was published on December 16, 2025, and affects Linux kernel versions in the ranges 6.12.54–6.12.56 and 6.17.4–6.17.6, among other commit-range-defined versions. The CVSS category is estimated as Medium, with an EPSS score of approximately 0.017% (Feedly, ENISA EUVD).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (CWE-362) in the Linux kernel slab allocator's alloc_slab_obj_exts() function. When two threads concurrently attempt to allocate the object extension vector for a slab, a thread that fails allocation may write the sentinel value OBJEXTS_ALLOC_FAIL to slab->obj_exts, overwriting a valid pointer already written by a competing thread. The fix replaces the non-atomic write with an atomic compare-and-exchange (cmpxchg()) operation, ensuring that slab->obj_exts is only updated if it has not already been set by another thread. Patches are available in the stable kernel tree at commits 6ed8bfd24ce1, 7c34feda6a9a, and c7af5300d784 (Feedly, Kernel Git).

Successful exploitation of this race condition can cause a NULL pointer dereference in the Linux kernel, leading to a kernel panic and system crash, which constitutes a denial-of-service condition. The vulnerability affects the availability of any Linux system running a vulnerable kernel version, particularly under concurrent memory allocation workloads. There is no direct evidence of confidentiality or integrity impact, as the primary consequence is system instability or crash (Feedly, ENISA EUVD).

There is no known public proof-of-concept exploit or evidence of in-the-wild exploitation for CVE-2025-40348. The vulnerability requires concurrent execution of two threads both entering alloc_slab_obj_exts() simultaneously, making reliable exploitation dependent on specific timing conditions. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It has been detected by Nessus plugin 278925 (Feedly, Tenable).

The fix has been merged into the Linux stable kernel tree. Administrators should update to kernel versions 6.12.56 or later (for the 6.12.x branch) and 6.17.6 or later (for the 6.17.x branch), or apply the specific commits 6ed8bfd24ce1cb31742b09a3eb557cd008533eec, 7c34feda6a9a203c9744281f1b6671b7dad2012d, and c7af5300d78460fc5037ddc77113ba3dbfe77dc0 from the stable kernel tree. Distribution vendors (e.g., Red Hat, Ubuntu, SUSE) should be monitored for backported patches to their supported kernel versions. No configuration-based workaround is known; upgrading the kernel is the recommended remediation (Feedly, Kernel Git).