github - ghsa-53xm-w39p-m328

ghsa-53xm-w39p-m328

Vulnerability from github

Published

2025-09-12 18:31

Modified

2025-09-12 18:31

Details

In the Linux kernel, the following vulnerability has been resolved:

io_uring/memmap: cast nr_pages to size_t before shifting

If the allocated size exceeds UINT_MAX, then it's necessary to cast the mr->nr_pages value to size_t to prevent it from overflowing. In practice this isn't much of a concern as the required memory size will have been validated upfront, and accounted to the user. And > 4GB sizes will be necessary to make the lack of a cast a problem, which greatly exceeds normal user locked_vm settings that are generally in the kb to mb range. However, if root is used, then accounting isn't done, and then it's possible to hit this issue.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-39793"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-12T16:15:33Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/memmap: cast nr_pages to size_t before shifting\n\nIf the allocated size exceeds UINT_MAX, then it\u0027s necessary to cast\nthe mr-\u003enr_pages value to size_t to prevent it from overflowing. In\npractice this isn\u0027t much of a concern as the required memory size will\nhave been validated upfront, and accounted to the user. And \u003e 4GB sizes\nwill be necessary to make the lack of a cast a problem, which greatly\nexceeds normal user locked_vm settings that are generally in the kb to\nmb range. However, if root is used, then accounting isn\u0027t done, and\nthen it\u0027s possible to hit this issue.",
  "id": "GHSA-53xm-w39p-m328",
  "modified": "2025-09-12T18:31:09Z",
  "published": "2025-09-12T18:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39793"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/33503c083fda048c77903460ac0429e1e2c0e341"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a69a9b53c54e2d33e2a5b1ea4a9a71fd01c6cf3a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c6a2706e08b8a1b2d3740161c0977d38e596c1ee"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2025-39793 (GCVE-0-2025-39793)

Vulnerability from cvelistv5

Published

2025-09-12 15:59

Modified

2025-09-29 05:59

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: io_uring/memmap: cast nr_pages to size_t before shifting If the allocated size exceeds UINT_MAX, then it's necessary to cast the mr->nr_pages value to size_t to prevent it from overflowing. In practice this isn't much of a concern as the required memory size will have been validated upfront, and accounted to the user. And > 4GB sizes will be necessary to make the lack of a cast a problem, which greatly exceeds normal user locked_vm settings that are generally in the kb to mb range. However, if root is used, then accounting isn't done, and then it's possible to hit this issue.

References

▼	URL	Tags
	https://git.kernel.org/stable/c/c6a2706e08b8a1b2d3740161c0977d38e596c1ee
	https://git.kernel.org/stable/c/a69a9b53c54e2d33e2a5b1ea4a9a71fd01c6cf3a
	https://git.kernel.org/stable/c/33503c083fda048c77903460ac0429e1e2c0e341

Impacted products

Vendor

Product

Version

▼

Linux

Version: 087f997870a948820ec366701d178f402c6a23a3
Version: 087f997870a948820ec366701d178f402c6a23a3
Version: 087f997870a948820ec366701d178f402c6a23a3

Linux

Version: 6.14

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/memmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c6a2706e08b8a1b2d3740161c0977d38e596c1ee",
              "status": "affected",
              "version": "087f997870a948820ec366701d178f402c6a23a3",
              "versionType": "git"
            },
            {
              "lessThan": "a69a9b53c54e2d33e2a5b1ea4a9a71fd01c6cf3a",
              "status": "affected",
              "version": "087f997870a948820ec366701d178f402c6a23a3",
              "versionType": "git"
            },
            {
              "lessThan": "33503c083fda048c77903460ac0429e1e2c0e341",
              "status": "affected",
              "version": "087f997870a948820ec366701d178f402c6a23a3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/memmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/memmap: cast nr_pages to size_t before shifting\n\nIf the allocated size exceeds UINT_MAX, then it\u0027s necessary to cast\nthe mr-\u003enr_pages value to size_t to prevent it from overflowing. In\npractice this isn\u0027t much of a concern as the required memory size will\nhave been validated upfront, and accounted to the user. And \u003e 4GB sizes\nwill be necessary to make the lack of a cast a problem, which greatly\nexceeds normal user locked_vm settings that are generally in the kb to\nmb range. However, if root is used, then accounting isn\u0027t done, and\nthen it\u0027s possible to hit this issue."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-29T05:59:33.153Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c6a2706e08b8a1b2d3740161c0977d38e596c1ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/a69a9b53c54e2d33e2a5b1ea4a9a71fd01c6cf3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/33503c083fda048c77903460ac0429e1e2c0e341"
        }
      ],
      "title": "io_uring/memmap: cast nr_pages to size_t before shifting",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39793",
    "datePublished": "2025-09-12T15:59:30.388Z",
    "dateReserved": "2025-04-16T07:20:57.132Z",
    "dateUpdated": "2025-09-29T05:59:33.153Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted