gh-155376: prevent supercheck NULL dereference

Lib/test/test_super.py

@@ -437,6 +437,11 @@ def method(self, type_, obj):
                 with self.assertRaisesRegex(TypeError, regex):
                     c.method(type_, obj)
 
+    def test_supercheck_uninitialized_super(self):
+        s = super.__new__(super)
+        with self.assertRaisesRegex(TypeError, "super object has no type"):
+            s.__get__(1)
+
     def test_super___class__(self):
         class C:
             def method(self):

Misc/NEWS.d/next/Core_and_Builtins/2026-08-08-14-04-39.gh-issue-155376.NkZ4mI.rst

@@ -0,0 +1,2 @@
+Fix a crash in :func:`super` when an uninitialized ``super`` object created
+with ``super.__new__(super)`` was used as a descriptor.

Objects/typeobject.c

@@ -12562,6 +12562,12 @@ supercheck(PyTypeObject *type, PyObject *obj)
        This will allow using super() with a proxy for obj.
     */
 
+    if (type == NULL) {
+        PyErr_SetString(PyExc_TypeError,
+                        "super object has no type");
+        return NULL;
+    }
+
     /* Check for first bullet above (special case) */
     if (PyType_Check(obj) && PyType_IsSubtype((PyTypeObject *)obj, type)) {
         return (PyTypeObject *)Py_NewRef(obj);
@@ -12642,8 +12648,7 @@ super_descr_get(PyObject *self, PyObject *obj, PyObject *type)
         PyTypeObject *obj_type = supercheck(su->type, obj);
         if (obj_type == NULL)
             return NULL;
-        newobj = (superobject *)PySuper_Type.tp_new(&PySuper_Type,
-                                                 NULL, NULL);
+        newobj = (superobject *)PySuper_Type.tp_alloc(&PySuper_Type, 0);
         if (newobj == NULL) {
             Py_DECREF(obj_type);
             return NULL;