Cloudanix VulnDB

CVE-2025-68199

None

CVSS

—

EPSS

0.2%

Published

Dec 16, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in how the Linux kernel manages certain memory tracking structures can make the computer crash and restart without warning.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw resides in mark_objexts_empty() within the Linux kernel SLUB allocator debug path; when a slab extension vector previously marked with CODETAG_EMPTY is reused and later freed, the function incorrectly triggers a BUG_ON instead of skipping the empty check, resulting in a kernel panic during __free_slab().

Why it matters to the business

Systems running affected Chainguard GitLab container images or upstream Linux kernels may experience unexpected crashes during memory-intensive operations, leading to service outages, loss of in-flight work, and required reboots; urgency is moderate given the 315 days since publication, stable low EPSS, and absence from CISA KEV or ransomware campaigns.

How an attack unfolds

An attacker with local access crafts a sequence of slab allocations that intentionally fails then succeeds, forcing reuse of a CODETAG_EMPTY-marked extension vector; subsequent freeing of the dependent slab triggers the BUG in mark_objexts_empty(), crashing the kernel. No named threat actors or campaigns are associated with this issue.

How to fix it

Upgrade all affected packages to the listed fixed versions: gitlab-cng-fips-17.6 and related Chainguard images to 17.6.5-r0; Linux kernel to commit fc6acd4cddf76e7eb7db63649fe36980ce208f56 or later stable releases containing the mark_objexts_empty() fix. Reboot after kernel updates.

How to confirm the fix worked

Verify the running kernel contains fc6acd4cddf76e7eb7db63649fe36980ce208f56 or equivalent; confirm no occurrences of the original BUG string "kernel BUG at mm/slub.c:2050" after applying the update under memory-pressure workloads.

Typical attack path

  1. Obtain local code execution on an affected Linux system
  2. Trigger repeated slab allocation failures followed by successful allocations for slabobj_ext vectors
  3. Cause a dependent slab (slabB) to be freed, invoking free_slab_obj_exts()
  4. Reach the BUG_ON in mark_objexts_empty() and induce kernel panic

How to detect it

Search kernel logs and dmesg for the crash signature "kernel BUG at mm/slub.c:2050" or "Internal error: Oops - BUG"; inspect call traces containing __free_slab, free_slab_obj_exts, and mark_objexts_empty under KASAN or codetag debug builds.

  • kernel BUG at mm/slub.c:2050
  • __free_slab+0x228/0x250
  • mark_objexts_empty
  • CODETAG_EMPTY

What your security team should do

  • Prioritize patching kernel packages in all Chainguard GitLab deployments within the next maintenance window
  • Monitor EPSS and KEV updates for any change in exploit maturity
  • Test the fix under simulated slab allocation failure scenarios before broad rollout

The record

In the Linux kernel, the following vulnerability has been resolved: codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext When alloc_slab_obj_exts() fails and then later succeeds in allocating a slab extension vector, it calls handle_failed_objexts_alloc() to mark all objects in the vector as empty. As a result all objects in this slab (slabA) will have their extensions set to CODETAG_EMPTY. Later on if this slabA is used to allocate a slabobj_ext vector for another slab (slabB), we end up with the slabB->obj_exts pointing to a slabobj_ext vector that itself has a non-NULL slabobj_ext equal to CODETAG_EMPTY. When slabB gets freed, free_slab_obj_exts() is called to free slabB->obj_exts vector. free_slab_obj_exts() calls mark_objexts_empty(slabB->obj_exts) which will generate a warning because it expects slabobj_ext vectors to have a NULL obj_ext, not CODETAG_EMPTY. Modify mark_objexts_empty() to skip the warning and setting the obj_ext value if it's already set to CODETAG_EMPTY. To quickly detect this WARN, I modified the code from WARN_ON(slab_exts[offs].ref.ct) to BUG_ON(slab_exts[offs].ref.ct == 1); We then obtained this message: [21630.898561] ------------[ cut here ]------------ [21630.898596] kernel BUG at mm/slub.c:2050! [21630.898611] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [21630.900372] Modules linked in: squashfs isofs vfio_iommu_type1 vhost_vsock vfio vhost_net vmw_vsock_virtio_transport_common vhost tap vhost_iotlb iommufd vsock binfmt_misc nfsv3 nfs_acl nfs lockd grace netfs tls rds dns_resolver tun brd overlay ntfs3 exfat btrfs blake2b_generic xor xor_neon raid6_pq loop sctp ip6_udp_tunnel udp_tunnel nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables rfkill ip_set sunrpc vfat fat joydev sg sch_fq_codel nfnetlink virtio_gpu sr_mod cdrom drm_client_lib virtio_dma_buf drm_shmem_helper drm_kms_helper drm ghash_ce backlight virtio_net virtio_blk virtio_scsi net_failover virtio_console failover virtio_mmio dm_mirror dm_region_hash dm_log dm_multipath dm_mod fuse i2c_dev virtio_pci virtio_pci_legacy_dev virtio_pci_modern_dev virtio virtio_ring autofs4 aes_neon_bs aes_ce_blk [last unloaded: hwpoison_inject] [21630.909177] CPU: 3 UID: 0 PID: 3787 Comm: kylin-process-m Kdump: loaded Tainted: G        W           6.18.0-rc1+ #74 PREEMPT(voluntary) [21630.910495] Tainted: [W]=WARN [21630.910867] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 [21630.911625] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [21630.912392] pc : __free_slab+0x228/0x250 [21630.912868] lr : __free_slab+0x18c/0x250[21630.913334] sp : ffff8000a02f73e0 [21630.913830] x29: ffff8000a02f73e0 x28: fffffdffc43fc800 x27: ffff0000c0011c40 [21630.914677] x26: ffff0000c000cac0 x25: ffff00010fe5e5f0 x24: ffff000102199b40 [21630.915469] x23: 0000000000000003 x22: 0000000000000003 x21: ffff0000c0011c40 [21630.916259] x20: fffffdffc4086600 x19: fffffdffc43fc800 x18: 0000000000000000 [21630.917048] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [21630.917837] x14: 0000000000000000 x13: 0000000000000000 x12: ffff70001405ee66 [21630.918640] x11: 1ffff0001405ee65 x10: ffff70001405ee65 x9 : ffff800080a295dc [21630.919442] x8 : ffff8000a02f7330 x7 : 0000000000000000 x6 : 0000000000003000 [21630.920232] x5 : 0000000024924925 x4 : 0000000000000001 x3 : 0000000000000007 [21630.921021] x2 : 0000000000001b40 x1 : 000000000000001f x0 : 0000000000000001 [21630.921810] Call trace: [21630.922130]  __free_slab+0x228/0x250 (P) [21630.922669]  free_slab+0x38/0x118 [21630.923079]  free_to_partial_list+0x1d4/0x340 [21630.923591]  __slab_free+0x24c/0x348 [21630.924024]  ___cache_free+0xf0/0x110 [21630.924468]  qlist_free_all+0x78/0x130 [21630.924922]  kasan_quarantine_reduce+0x11 ---truncated---

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 6.10.0 6.12.59

Related vulnerabilities