Memory Allocation Vulnerability in Linux Kernel Affecting Multiple Distributions

CVE-2025-38517

What is CVE-2025-38517?

The Linux kernel exhibits a vulnerability within the memory allocation system due to improper semaphore locking in the alloc_tag_top_users function. This vulnerability arises when alloc_tag_cttype is either unallocated or initialized incorrectly, leading to a crash on memory allocation failure. If the alloc_tag_cttype is null or represents an error state, an attempt to acquire a non-existent semaphore occurs, causing a general protection fault. The vulnerability is easier to trigger under specific conditions, especially when memory profiling is disabled during boot, making it critical for system stability.

References