fs: Prevent file descriptor table allocations exceeding INT_MAX
In the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c: WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288 This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN. Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate: - File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes - Multiple bitmaps: ~400MB - Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647) Reproducer: 1. Set /proc/sys/fs/nr_open to 1073741816: # echo 1073741816 > /proc/sys/fs/nr_open 2. Run a program that uses a high file descriptor: #include #include int main() { struct rlimit rlim = {1073741824, 1073741824}; setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; } 3. Observe WARNING in dmesg at mm/slub.c:5027 systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descripto
CVE-2025-39756
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-39756
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
"lessThan": "b4159c5a90c03f8acd3de345a7f5fc63b0909818",
"versionType": "git"
},
{
"status": "affected",
"version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
"lessThan": "f95638a8f22eba307dceddf5aef9ae2326bbcf98",
"versionType": "git"
},
{
"status": "affected",
"version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
"lessThan": "749528086620f8012b83ae032a80f6ffa80c45cd",
"versionType": "git"
},
{
"status": "affected",
"version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
"lessThan": "628fc28f42d979f36dbf75a6129ac7730e30c04e",
"versionType": "git"
},
{
"status": "affected",
"version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
"lessThan": "237e416eb62101f21b28c9e6e564d10efe1ecc6f",
"versionType": "git"
},
{
"status": "affected",
"version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
"lessThan": "d4f9351243c17865a8cdbe6b3ccd09d0b13a7bcc",
"versionType": "git"
},
{
"status": "affected",
"version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
"lessThan": "9f61fa6a2a89a610120bc4e5d24379c667314b5c",
"versionType": "git"
},
{
"status": "affected",
"version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
"lessThan": "dfd1f4ea98c3bd3a03d12169b5b2daa1f0a3e4ae",
"versionType": "git"
},
{
"status": "affected",
"version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
"lessThan": "04a2c4b4511d186b0fce685da21085a5d4acd370",
"versionType": "git"
}
],
"programFiles": [
"fs/file.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.25",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.4.297",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.241",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.190",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.149",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.103",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.43",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.15.11",
"versionType": "semver",
"lessThanOrEqual": "6.15.*"
},
{
"status": "unaffected",
"version": "6.16.2",
"versionType": "semver",
"lessThanOrEqual": "6.16.*"
},
{
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/file.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-39756
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #27062 · Revision 1
- Added to Heist Feed
- Publisher date