CVE-2025-39793
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-12

Last updated on: 2025-11-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/memmap: cast nr_pages to size_t before shifting If the allocated size exceeds UINT_MAX, then it's necessary to cast the mr->nr_pages value to size_t to prevent it from overflowing. In practice this isn't much of a concern as the required memory size will have been validated upfront, and accounted to the user. And > 4GB sizes will be necessary to make the lack of a cast a problem, which greatly exceeds normal user locked_vm settings that are generally in the kb to mb range. However, if root is used, then accounting isn't done, and then it's possible to hit this issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-12
Last Modified
2025-11-25
Generated
2026-05-07
AI Q&A
2025-09-12
EPSS Evaluated
2026-05-05
NVD
CVE-2025-39793
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 5.15.160 (inc) to 5.16 (inc)
linux linux_kernel From 5.15.160 (inc) to 5.16 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-NVD-CWE-noinfo
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in the Linux kernel's io_uring memory mapping code occurs because the number of pages (nr_pages) was not cast to size_t before shifting, which can cause an integer overflow if the allocated size exceeds UINT_MAX. This overflow can lead to incorrect memory size calculations. While normal users are generally protected due to memory size validations and limits, root users can trigger this issue because accounting is not done for them.


How can this vulnerability impact me? :

If exploited, this vulnerability could cause incorrect memory allocation calculations leading to potential memory corruption or unexpected behavior in the kernel. This is mainly a concern for root users who can bypass normal memory accounting, possibly resulting in system instability or security risks.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the io_uring/memmap issue is fixed. Avoid running processes as root that allocate memory sizes exceeding UINT_MAX without proper accounting. Applying the latest kernel patches that include the fix for casting nr_pages to size_t before shifting is recommended.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart