Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-39793— io_uring/memmap: cast nr_pages to size_t before shifting

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未将nr_pages转换为size_t类型，可能导致整数溢出。

CVSS 7.8 · High EPSS 0.15% · P4

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux 087f997870a948820ec366701d178f402c6a23a3< c6a2706e08b8a1b2d3740161c0977d38e596c1ee affected
087f997870a948820ec366701d178f402c6a23a3< a69a9b53c54e2d33e2a5b1ea4a9a71fd01c6cf3a affected
087f997870a948820ec366701d178f402c6a23a3< 33503c083fda048c77903460ac0429e1e2c0e341 affected
6.14 affected
< 6.14 unaffected
6.15.11≤ 6.15.* unaffected
6.16.2≤ 6.16.* unaffected
6.17≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-39793

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
io_uring/memmap: cast nr_pages to size_t before shifting
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/memmap: cast nr_pages to size_t before shifting If the allocated size exceeds UINT_MAX, then it's necessary to cast the mr->nr_pages value to size_t to prevent it from overflowing. In practice this isn't much of a concern as the required memory size will have been validated upfront, and accounted to the user. And > 4GB sizes will be necessary to make the lack of a cast a problem, which greatly exceeds normal user locked_vm settings that are generally in the kb to mb range. However, if root is used, then accounting isn't done, and then it's possible to hit this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未将nr_pages转换为size_t类型，可能导致整数溢出。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 087f997870a948820ec366701d178f402c6a23a3 ~ c6a2706e08b8a1b2d3740161c0977d38e596c1ee -
Linux Linux 6.14 -

II. Public POCs for CVE-2025-39793

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-39793

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-09-12 · 7 CVEs total

CVE-2025-39792 7.8 HIGH dm: Always split write BIOs to zoned device limits
CVE-2025-39798 7.3 HIGH NFS: Fix the setting of capabilities when automounting a new filesystem
CVE-2025-39794 ARM: tegra: Use I/O memcpy to write to IRAM
CVE-2025-39795 block: avoid possible overflow for chunk_sectors check in blk_stack_limits()
CVE-2025-39796 net: lapbether: ignore ops-locked netdevs
CVE-2025-39797 xfrm: Duplicate SPI Handling

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-39793

No comments yet

Leave a comment