CVE-2025-37774 is a vulnerability identified in the Linux kernel's slab allocator subsystem, specifically related to the initialization of the slab->obj_exts field during slab page allocation. The slab allocator is a critical memory management component responsible for efficient allocation and deallocation of kernel objects. The vulnerability arises because slab->obj_exts is not properly cleared (zeroed out) when a new slab page is allocated. This leads to the presence of residual bits in slab->obj_exts that are outside the expected range used by page_memcg_data_flags and objext_flags. Consequently, when slab_obj_exts() attempts to obtain the pointer stored in slab->obj_exts, it may dereference an invalid address, resulting in a NULL pointer dereference and kernel crash (kernel oops). The issue was detected through crashes reported by ktest during buffered I/O tests, with the crash stack trace pointing to __alloc_tagging_slab_alloc_hook(). The crash logs indicate a level 1 translation fault due to invalid memory access at a low virtual address (0x10), which is symptomatic of dereferencing an uninitialized or corrupted pointer. The root cause is the failure to initialize slab->obj_exts during slab page allocation, which is a programming error in the kernel memory allocator. Although the exact reason why these crashes started occurring recently is unclear, the fix involves explicitly zeroing out slab->obj_exts when allocating a slab page to prevent invalid pointer dereferences. This vulnerability can cause system instability and kernel panics, leading to denial of service (DoS) conditions. There is no indication that this vulnerability allows privilege escalation or arbitrary code execution. No known exploits are reported in the wild as of the publication date.

For European organizations, this vulnerability poses a significant risk to the stability and availability of Linux-based systems, which are widely used in servers, cloud infrastructure, and embedded devices. A kernel panic triggered by this flaw can cause unexpected system reboots or crashes, disrupting critical services and operations. Organizations relying on Linux for web hosting, database servers, or network infrastructure may experience downtime, impacting business continuity and service level agreements. Although this vulnerability does not appear to enable direct compromise of confidentiality or integrity, the denial of service impact can be severe, especially in environments requiring high availability such as financial institutions, healthcare providers, and government agencies. Additionally, the debugging and remediation efforts may require system downtime, further affecting operational efficiency. The absence of known exploits reduces immediate risk, but the vulnerability's presence in the kernel memory allocator means that any triggered crash could be leveraged by attackers to cause persistent denial of service. European organizations with large-scale Linux deployments, particularly those using kernel versions around 6.15.0-rc1 or similar, should prioritize patching to maintain system reliability.

1. Immediate application of the official Linux kernel patch that initializes slab->obj_exts during slab page allocation is essential. Organizations should track kernel updates from trusted sources and deploy them promptly. 2. For environments where immediate patching is not feasible, implement kernel crash monitoring and automated reboot mechanisms to minimize downtime impact. 3. Conduct thorough testing of kernel updates in staging environments to ensure compatibility and stability before production deployment. 4. Employ kernel hardening techniques such as Kernel Address Space Layout Randomization (KASLR) and Kernel Page Table Isolation (KPTI) to reduce the attack surface, although these do not directly mitigate this specific flaw. 5. Maintain comprehensive system and kernel logs to detect and analyze any kernel oops or crashes related to slab allocator issues. 6. Limit access to systems running vulnerable kernel versions to trusted personnel and networks to reduce the risk of accidental or malicious triggering of the vulnerability. 7. Engage with Linux distribution vendors for backported patches if using long-term support (LTS) kernels to ensure timely remediation. 8. Consider implementing redundancy and failover mechanisms in critical systems to maintain service availability in case of kernel crashes.