{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/slub.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "570a6aaf6b52c6ec098f4811cdb52b1496f13d15",
              "status": "affected",
              "version": "ba742531260782a2646bc031f9a12cafebc22594",
              "versionType": "git"
            },
            {
              "lessThan": "4a724bcf5d703e18957397914d79156fa2cf1174",
              "status": "affected",
              "version": "ba742531260782a2646bc031f9a12cafebc22594",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/slub.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.2"
            },
            {
              "lessThan": "7.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "7.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab: take n-\u003elist_lock in __slab_try_return_freelist() to avoid race\n\nCommit ba7425312607 (\"mm, slab: add an optimistic\n__slab_try_return_freelist()\") incorrectly assumed that nobody has freed\nan object to the slab as long as slab-\u003efreelist is NULL and cmpxchg\nsucceeds.\n\nHowever, as reported by Hyunwoo Kim [1], other CPUs might have freed\nan object to the slab, insert the slab to the partial list, then\nallocated an object from the slab, and be in the middle of removing\nthe slab from the list under n-\u003elist_lock.\n\nSince __refill_objects_node() puts the slab back on pc.slabs\noutside n-\u003elist_lock, it might insert the slab into that list while\nthe slab is concurrently being removed from n-\u003epartial.\nThis led to a list corruption [1]:\n\n  list_add corruption. next-\u003eprev should be prev\n  (ffff888100000248), but was dead000000000122.\n  (next=ffffea000416e410).\n  kernel BUG at lib/list_debug.c:29!\n  Oops: invalid opcode: 0000 [#1] SMP NOPTI\n  CPU: 1 UID: 65534 PID: 144 Comm: poc Not tainted\n  7.2.0-16172-gcf72cbb39da8-dirty #1 PREEMPT(lazy)\n  RIP: 0010:__list_add_valid_or_report+0x80/0xd0\n  ...\n  Call Trace:\n   alloc_from_new_slab+0x183/0x300\n   ___slab_alloc+0x31c/0x890\n   __kmalloc_noprof+0x3d4/0x800\n   lsm_blob_alloc+0x2d/0x50\n   security_msg_msg_alloc+0x26/0x90\n   load_msg+0x1aa/0x210\n   do_msgsnd+0x91/0x800\n   do_syscall_64+0x109/0x5d0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  ...\n  Kernel panic - not syncing: Fatal exception\n\nThis is a classic ABA problem where cmpxchg succeeds but the state has\nchanged since __refill_objects_node() took the freelist from the slab.\n\nAs Vlastimil Babka mentioned [2], it should be rare to return more than\none slab (due to the racy read of slab-\u003ecounters in\nget_partial_node_bulk()). Therefore, instead of introducing additional\ncomplexity, acquire and release n-\u003elist_lock twice in the worst case.\n\nReturn the slab directly to the partial list and hold n-\u003elist_lock\nacross the cmpxchg and add_partial(). This is similar to the initial\nversion of commit ba7425312607 [3]. This is enough to avoid the race as\nthe list manipulation is serialized by n-\u003elist_lock. While at it,\nbring back unlikely() hint now that the condition is unlikely."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is in __refill_objects_node()/__slab_try_return_freelist() in mm/slub.c, which runs when the slab allocator refills its per-CPU object cache for kmalloc. It is reached from local syscalls such as msgsnd() (do_msgsnd -\u003e load_msg -\u003e __kmalloc -\u003e ___slab_alloc in the reporter\u0027s trace). No remote data is involved.\nAC:L - The attacker\u0027s own threads on several CPUs do the allocating and freeing (e.g. msgsnd/msgrcv) that returns the slab to n-\u003epartial and pulls it off again while the refill re-links it outside n-\u003elist_lock. The attacker drives both sides of the race, and the reporter\u0027s reproducer hit it.\nPR:L - No capability is needed. Any unprivileged process that does kmalloc-backed syscalls reaches the refill path, and the reported crash came from a process running as UID 65534 (nobody) calling msgsnd.\nUI:N - The attacker triggers the race entirely with their own allocation and free syscalls. No other user has to do anything.\nS:U - The corruption is in the kernel\u0027s own slab lists, and the impact stays within the kernel\u0027s security authority as ordinary local privilege escalation or crash.\nC:H - The ABA race leaves slab-\u003eslab_list linked on both the local pc.slabs list and n-\u003epartial. The same slab can then be handed out twice, giving overlapping kmalloc objects (a use-after-free-class primitive) that can be groomed to read kernel memory.\nI:H - A slab handed out twice lets an attacker put a controlled object (e.g. msg_msg) on top of a live kernel object in a general kmalloc cache. That enables arbitrary write and control-flow hijack, and the corrupted list pointers are themselves a write primitive.\nA:H - The reproducer hits a list_add corruption BUG (next-\u003eprev = dead000000000122) in alloc_from_new_slab and the kernel panics with \"Fatal exception\". An unprivileged user can repeat this at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:11:07.833Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/570a6aaf6b52c6ec098f4811cdb52b1496f13d15"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a724bcf5d703e18957397914d79156fa2cf1174"
        }
      ],
      "title": "mm/slab: take n-\u003elist_lock in __slab_try_return_freelist() to avoid race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97941",
    "datePublished": "2026-09-25T10:22:53.556Z",
    "dateReserved": "2026-09-25T10:18:58.204Z",
    "dateUpdated": "2026-10-19T09:11:07.833Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}