CVE-2025-39793
published 2025-09-12CVE-2025-39793: In the Linux kernel, the following vulnerability has been resolved: io_uring/memmap: cast nr_pages to size_t before shifting If the allocated size exceeds…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
3.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
io_uring/memmap: cast nr_pages to size_t before shifting
If the allocated size exceeds UINT_MAX, then it's necessary to cast
the mr->nr_pages value to size_t to prevent it from overflowing. In
practice this isn't much of a concern as the required memory size will
have been validated upfront, and accounted to the user. And > 4GB sizes
will be necessary to make the lack of a cast a problem, which greatly
exceeds normal user locked_vm settings that are generally in the kb to
mb range. However, if root is used, then accounting isn't done, and
then it's possible to hit this issue.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.16.3-1 (forky) | linux 6.16.3-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 087f997870a948820ec366701d178f402c6a23a3 < c6a2706e08b8a1b2d3740161c0977d38e596c1ee | c6a2706e08b8a1b2d3740161c0977d38e596c1ee |
| linux | linux | >= 087f997870a948820ec366701d178f402c6a23a3 < a69a9b53c54e2d33e2a5b1ea4a9a71fd01c6cf3a | a69a9b53c54e2d33e2a5b1ea4a9a71fd01c6cf3a |
| linux | linux | >= 087f997870a948820ec366701d178f402c6a23a3 < 33503c083fda048c77903460ac0429e1e2c0e341 | 33503c083fda048c77903460ac0429e1e2c0e341 |
| linux | linux_kernel | >= 0 < 6.16.3-1 | 6.16.3-1 |
| linux | linux_kernel | >= 6.14 < 6.15.11 | 6.15.11 |
| linux | linux_kernel | >= 6.16 < 6.16.2 | 6.16.2 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: io_uring/memmap: cast nr_pages to size_t before shifting
vendor_redhat·2025-09-12·CVSS 7.8
CVE-2025-39793 [HIGH] CWE-190 kernel: io_uring/memmap: cast nr_pages to size_t before shifting
kernel: io_uring/memmap: cast nr_pages to size_t before shifting
In the Linux kernel, the following vulnerability has been resolved:
io_uring/memmap: cast nr_pages to size_t before shifting
If the allocated size exceeds UINT_MAX, then it's necessary to cast
the mr->nr_pages value to size_t to prevent it from overflowing. In
practice this isn't much of a concern as the required memory size will
have been validated upfront, and accounted to the user. And > 4GB sizes
will be necessary to make the lack of a cast a problem, which greatly
exceeds normal user locked_vm settings that are generally in the kb to
mb range. However, if root is used, then accounting isn't done, and
then it's possible to hit this issue.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red
Debian
CVE-2025-39793: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/me...
vendor_debian·2025·CVSS 7.8
CVE-2025-39793 [HIGH] CVE-2025-39793: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/me...
In the Linux kernel, the following vulnerability has been resolved: io_uring/memmap: cast nr_pages to size_t before shifting If the allocated size exceeds UINT_MAX, then it's necessary to cast the mr->nr_pages value to size_t to prevent it from overflowing. In practice this isn't much of a concern as the required memory size will have been validated upfront, and accounted to the user. And > 4GB sizes will be necessary to make the lack of a cast a problem, which greatly exceeds normal user locked_vm settings that are generally in the kb to mb range. However, if root is used, then accounting isn't done, and then it's possible to hit this issue.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.16.3-1)
sid: resolved (fixed in 6.16.3-1)
trixie: resolved
GHSA
GHSA-53xm-w39p-m328: In the Linux kernel, the following vulnerability has been resolved:
io_uring/memmap: cast nr_pages to size_t before shifting
If the allocated size e
ghsa_unreviewed·2025-09-12
CVE-2025-39793 [HIGH] GHSA-53xm-w39p-m328: In the Linux kernel, the following vulnerability has been resolved:
io_uring/memmap: cast nr_pages to size_t before shifting
If the allocated size e
In the Linux kernel, the following vulnerability has been resolved:
io_uring/memmap: cast nr_pages to size_t before shifting
If the allocated size exceeds UINT_MAX, then it's necessary to cast
the mr->nr_pages value to size_t to prevent it from overflowing. In
practice this isn't much of a concern as the required memory size will
have been validated upfront, and accounted to the user. And > 4GB sizes
will be necessary to make the lack of a cast a problem, which greatly
exceeds normal user locked_vm settings that are generally in the kb to
mb range. However, if root is used, then accounting isn't done, and
then it's possible to hit this issue.
OSV
CVE-2025-39793: In the Linux kernel, the following vulnerability has been resolved: io_uring/memmap: cast nr_pages to size_t before shifting If the allocated size exc
osv·2025-09-12·CVSS 7.8
CVE-2025-39793 [HIGH] CVE-2025-39793: In the Linux kernel, the following vulnerability has been resolved: io_uring/memmap: cast nr_pages to size_t before shifting If the allocated size exc
In the Linux kernel, the following vulnerability has been resolved: io_uring/memmap: cast nr_pages to size_t before shifting If the allocated size exceeds UINT_MAX, then it's necessary to cast the mr->nr_pages value to size_t to prevent it from overflowing. In practice this isn't much of a concern as the required memory size will have been validated upfront, and accounted to the user. And > 4GB sizes will be necessary to make the lack of a cast a problem, which greatly exceeds normal user locked_vm settings that are generally in the kb to mb range. However, if root is used, then accounting isn't done, and then it's possible to hit this issue.
No detection rules found.
No public exploits indexed.
2025-09-12
Published