CVE-2025-39756
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-11

Last updated on: 2025-11-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c: WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288 This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN. Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate: - File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes - Multiple bitmaps: ~400MB - Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647) Reproducer: 1. Set /proc/sys/fs/nr_open to 1073741816: # echo 1073741816 > /proc/sys/fs/nr_open 2. Run a program that uses a high file descriptor: #include <unistd.h> #include <sys/resource.h> int main() { struct rlimit rlim = {1073741824, 1073741824}; setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; } 3. Observe WARNING in dmesg at mm/slub.c:5027 systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that: 1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting 2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations 3. The resulting allocations (>8GB) are impractical and will always fail systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors. While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue. Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-11
Last Modified
2025-11-03
Generated
2026-05-07
AI Q&A
2025-09-11
EPSS Evaluated
2026-05-05
NVD
CVE-2025-39756
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
linux kernel 5.10.244-1
linux kernel 6.1.153-1
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability occurs in the Linux kernel when the maximum number of file descriptors (nr_open) is set to a very high value, such as 1073741816. Under these conditions, processes attempting to use file descriptors near this limit can trigger very large memory allocation attempts that exceed the maximum integer size (INT_MAX). This leads to kernel warnings and impractical memory allocation requests exceeding 8GB, which will fail. The issue arises because the kernel's allocation functions enforce INT_MAX as a maximum size, but systemd's automatic setting of nr_open to a high value overlooked this limit. The fix involves adding a check to prevent allocation sizes exceeding INT_MAX, causing the operation to fail gracefully instead of triggering warnings and large allocations.


How can this vulnerability impact me? :

If your system has nr_open set to a very high value, processes that use file descriptors near this limit can cause the kernel to attempt massive memory allocations exceeding INT_MAX, resulting in kernel warnings and failed allocations. This can lead to instability or unexpected failures in programs that test or use high file descriptor numbers, potentially affecting system reliability or causing denial of service in extreme cases.


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by monitoring the kernel logs for WARNING messages related to memory allocation failures in mm/slub.c at line 5027. Specifically, you can check for warnings triggered by large file descriptor allocations exceeding INT_MAX. Use the command: dmesg | grep 'WARNING.*mm/slub.c:5027' to find relevant warnings. Additionally, checking the value of /proc/sys/fs/nr_open for unusually high settings (e.g., 1073741816) can help identify if the system is configured in a way that might trigger this issue.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability immediately, reduce the value of /proc/sys/fs/nr_open to a safer limit below INT_MAX (2,147,483,647) to prevent excessive file descriptor table allocations. Avoid setting nr_open to very high values like 1073741816. Additionally, update the Linux kernel to a version that includes the fix which adds a check in alloc_fdtable() to prevent allocations exceeding INT_MAX, causing the operation to fail gracefully instead of triggering large memory allocations and warnings.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart