CVE-2025-39793 (GCVE-0-2025-39793)

Vulnerability from cvelistv5 – Published: 2025-09-12 15:59 – Updated: 2026-08-05 12:05
VLAI
Title
io_uring/memmap: cast nr_pages to size_t before shifting
Summary
In the Linux kernel, the following vulnerability has been resolved: io_uring/memmap: cast nr_pages to size_t before shifting If the allocated size exceeds UINT_MAX, then it's necessary to cast the mr->nr_pages value to size_t to prevent it from overflowing. In practice this isn't much of a concern as the required memory size will have been validated upfront, and accounted to the user. And > 4GB sizes will be necessary to make the lack of a cast a problem, which greatly exceeds normal user locked_vm settings that are generally in the kb to mb range. However, if root is used, then accounting isn't done, and then it's possible to hit this issue.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 087f997870a948820ec366701d178f402c6a23a3 , < c6a2706e08b8a1b2d3740161c0977d38e596c1ee (git)
Affected: 087f997870a948820ec366701d178f402c6a23a3 , < a69a9b53c54e2d33e2a5b1ea4a9a71fd01c6cf3a (git)
Affected: 087f997870a948820ec366701d178f402c6a23a3 , < 33503c083fda048c77903460ac0429e1e2c0e341 (git)
Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.15.11 , ≤ 6.15.* (semver)
Unaffected: 6.16.2 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/memmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c6a2706e08b8a1b2d3740161c0977d38e596c1ee",
              "status": "affected",
              "version": "087f997870a948820ec366701d178f402c6a23a3",
              "versionType": "git"
            },
            {
              "lessThan": "a69a9b53c54e2d33e2a5b1ea4a9a71fd01c6cf3a",
              "status": "affected",
              "version": "087f997870a948820ec366701d178f402c6a23a3",
              "versionType": "git"
            },
            {
              "lessThan": "33503c083fda048c77903460ac0429e1e2c0e341",
              "status": "affected",
              "version": "087f997870a948820ec366701d178f402c6a23a3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/memmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/memmap: cast nr_pages to size_t before shifting\n\nIf the allocated size exceeds UINT_MAX, then it\u0027s necessary to cast\nthe mr-\u003enr_pages value to size_t to prevent it from overflowing. In\npractice this isn\u0027t much of a concern as the required memory size will\nhave been validated upfront, and accounted to the user. And \u003e 4GB sizes\nwill be necessary to make the lack of a cast a problem, which greatly\nexceeds normal user locked_vm settings that are generally in the kb to\nmb range. However, if root is used, then accounting isn\u0027t done, and\nthen it\u0027s possible to hit this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached purely through local syscalls \u2014 `io_uring_setup()` followed by `io_uring_register(IORING_REGISTER_MEM_REGION)` with an attacker-chosen `io_uring_region_desc.size`. Per kernel guidance, io_uring is a local attack vector.\nAC:L - This is a deterministic integer truncation fully controlled by the attacker\u0027s chosen region size (any value \u2265 4 GB with a small remainder); there is no race, no memory-layout dependency, and no condition outside the attacker\u0027s control. The only environmental factor is RLIMIT_MEMLOCK/CAP_IPC_LOCK, which is a target configuration rather than a probabilistic exploitation condition.\nPR:L - `io_uring_setup` and `IORING_REGISTER_MEM_REGION` require no capability at all under the default `kernel.io_uring_disabled=0`; the only gate is the `RLIMIT_MEMLOCK` counter check, which no actual memory allocation must satisfy since the allocation itself is truncated. On the many real deployments where non-root users have memlock unlimited (container runtimes, RDMA/OFED and DPDK hosts, HPC nodes, database service accounts), an ordinary unprivileged local user reaches this directly; with real root (`CAP_IPC_LOCK` in init_user_ns) accounting is skipped entirely.\nUI:N - The attacker performs the entire sequence \u2014 ring setup, region registration, and mmap of the param region \u2014 within their own process. No victim action is involved.\nS:U - The corruption and its consequences are contained within the kernel\u0027s own security authority on the same host; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The truncation causes `mr-\u003epages[]` to be populated with `struct page` pointers spanning ~4 GB of unrelated physical memory, which is then `vmap()`ed into the kernel and mmap-able into userspace via `io_region_mmap()`/`vm_insert_pages()`. This yields direct read access to arbitrary physical memory belonging to other processes and the kernel.\nI:H - The same foreign pages are inserted into a writable user VMA and aliased writable in the kernel vmap, giving an arbitrary physical-memory write primitive (e.g. modifying cached setuid binary text or kernel data), and `insert_page_into_pte_locked()` performs `folio_get()`/rmap accounting on folios the region never owned, corrupting refcounts into a use-after-free. This is straightforwardly leveraged into privilege escalation.\nA:H - `io_check_coalesce_buffer()` dereferences ~1M out-of-range `struct page` pointers, oopsing whenever the walk crosses unpopulated vmemmap, and the resulting refcount corruption/UAF on in-use pages causes kernel panics. Any local user able to trigger it can crash the machine repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:14.029Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c6a2706e08b8a1b2d3740161c0977d38e596c1ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/a69a9b53c54e2d33e2a5b1ea4a9a71fd01c6cf3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/33503c083fda048c77903460ac0429e1e2c0e341"
        }
      ],
      "title": "io_uring/memmap: cast nr_pages to size_t before shifting",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39793",
    "datePublished": "2025-09-12T15:59:30.388Z",
    "dateReserved": "2025-04-16T07:20:57.132Z",
    "dateUpdated": "2026-08-05T12:05:14.029Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39793",
      "date": "2026-08-09",
      "epss": "0.00141",
      "percentile": "0.03862"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39793\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-12T16:15:33.590\",\"lastModified\":\"2026-07-30T06:23:45.910\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio_uring/memmap: cast nr_pages to size_t before shifting\\n\\nIf the allocated size exceeds UINT_MAX, then it\u0027s necessary to cast\\nthe mr-\u003enr_pages value to size_t to prevent it from overflowing. In\\npractice this isn\u0027t much of a concern as the required memory size will\\nhave been validated upfront, and accounted to the user. And \u003e 4GB sizes\\nwill be necessary to make the lack of a cast a problem, which greatly\\nexceeds normal user locked_vm settings that are generally in the kb to\\nmb range. However, if root is used, then accounting isn\u0027t done, and\\nthen it\u0027s possible to hit this issue.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"io_uring/memmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"087f997870a948820ec366701d178f402c6a23a3\",\"lessThan\":\"c6a2706e08b8a1b2d3740161c0977d38e596c1ee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"087f997870a948820ec366701d178f402c6a23a3\",\"lessThan\":\"a69a9b53c54e2d33e2a5b1ea4a9a71fd01c6cf3a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"087f997870a948820ec366701d178f402c6a23a3\",\"lessThan\":\"33503c083fda048c77903460ac0429e1e2c0e341\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"io_uring/memmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.11\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.2\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.15.11\",\"matchCriteriaId\":\"6AB72A20-0D99-4FED-888D-A5B7CC969A64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16\",\"versionEndExcluding\":\"6.16.2\",\"matchCriteriaId\":\"BD7C087D-2415-4521-B624-30003352F899\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/33503c083fda048c77903460ac0429e1e2c0e341\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a69a9b53c54e2d33e2a5b1ea4a9a71fd01c6cf3a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c6a2706e08b8a1b2d3740161c0977d38e596c1ee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:58:31+00:00",
      "cve": "CVE-2025-39793",
      "id": "CVE-2025-39793",
      "initial_release_date": "2025-09-12T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: io_uring/memmap: cast nr_pages to size_t before shifting",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39793.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-07-25T00:40:13Z",
      "cve": "CVE-2025-39793",
      "id": "CVE-2025-39793",
      "initial_release_date": "2025-09-16T23:24:28Z",
      "product_status:known_not_affected": "416",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39793",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39793.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.