`super.__new__(super)` can create an object that causes a NULL dereference in supercheck()

Crash report

What happened?

super.__new__(super) can create a super object whose internal type field is NULL. Using that object as a descriptor then causes a segmentation fault in supercheck().

Minimal reproducer:

s = super.__new__(super)
print(s)
s.__get__(1)

Output:

<super: <class 'NULL'>, NULL>
Segmentation fault (core dumped)

The one-line form also reproduces the crash:

super.__new__(super).__get__(1)

This is deterministic on the tested build.

A normal initialized super object does not crash:

class A:
    pass

class B(A):
    pass

s = super(B, B())
print(s.__get__(B()))

Output:

<super: <class 'B'>, ...>

GDB confirms the NULL dereference:

Program received signal SIGSEGV, Segmentation fault.
supercheck (type=0x0, obj=...)
    at Objects/typeobject.c:12605

The crashing code is:

PyErr_Format(PyExc_TypeError,
            "super(type, obj): obj (%s %.200s) is not "
            "an instance or subtype of type (%.200s).",
            type_or_instance, obj_str, type->tp_name);

Here type == NULL, so evaluating type->tp_name dereferences NULL.

The relevant call path is:

super.__new__(super)
    -> PyType_GenericNew()
    -> uninitialized super object (su->type == NULL)
    -> super_descr_get()
    -> supercheck(su->type, obj)
    -> type->tp_name
    -> SIGSEGV

PySuper_Type currently uses PyType_GenericNew as its tp_new, while initialization of the internal fields is performed separately by super_init. Therefore direct use of super.__new__(super) bypasses that initialization.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.16.0a0 (heads/audit-objects-phase1-dirty:c3aefdb9eff, Aug 7 2026, 19:38:01) [GCC 13.3.0]

Linked PRs

• gh-155379

Start in Objects/typeobject.c at supercheck(), then trace PySuper_Type's PyType_GenericNew and the separate super_init path described in the report. Use the reproducer with super.new(super).get(1) as regression coverage; done means it no longer crashes and reports an appropriate error instead.