LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39793: io_uring/memmap: cast nr_pages to size_t before shifting

In the Linux kernel, the following vulnerability has been resolved: io_uring/memmap: cast nr_pages to size_t before shifting If the allocated size exceeds UINT_MAX, then it's necessary to cast the mr->nr_pages value to size_t to prevent it from overflowing. In practice this isn't much of a concern as the required memory size will have been validated upfront, and accounted to the user. And > 4GB sizes will be necessary to make the lack of a cast a problem, which greatly exceeds normal user locked_vm settings that are generally in the kb to mb range. However, if root is used, then accounting isn't done, and then it's possible to hit this issue.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux io_uring memory-mapping calculation can overflow when handling unusually large allocations, potentially producing unsafe memory behavior. The condition generally requires more than 4 GB and is constrained by normal locked-memory limits, but privileged root workloads may bypass that accounting. The supplied severity is high, although practical exposure appears narrow.

Executive priority

Treat as high priority on shared Linux infrastructure, privileged compute systems, and hosts with io_uring-heavy workloads. For systems with strict memory-lock limits and no relevant privileged usage, schedule remediation through normal kernel patching after confirming exposure. No evidence supplied supports emergency incident response for active exploitation.

Technical view

The vulnerable calculation shifts mr->nr_pages before converting it to size_t. When the allocation exceeds UINT_MAX, the intermediate value can overflow. The correction casts nr_pages before shifting. The source does not specify the resulting corruption path, and says prior size validation and user accounting normally make the condition difficult to reach.

Likely exposure

Exposure is limited to affected Linux kernels using io_uring memory mapping with exceptionally large allocations. Systems allowing privileged processes to create such mappings deserve priority. Ordinary users are usually constrained by locked-memory accounting, commonly far below the required size. The supplied version data is ambiguous and should be verified against distribution advisories or kernel commit history.

Exploitation context

The CVSS vector describes local, low-complexity access with privileges required and potentially high confidentiality, integrity, and availability impact. However, the technical description says practical triggering generally needs allocations above 4 GB and is most plausible as root. KEV is false, and the supplied sources provide no evidence of active exploitation or a public exploit.

Researcher notes

The core defect is an integer-width error in the page-count shift, corrected by converting nr_pages to size_t first. Source commentary substantially limits practical reachability, especially for accounted users. Precise affected-version boundaries and the concrete post-overflow consequence are not adequately explained in the bundle, so avoid assuming universal exploitability or a specific memory-corruption primitive.

Mitigation direction

  • Apply a vendor kernel update incorporating the relevant cited stable-kernel correction.
  • Verify distribution advisories because the supplied affected-version list is not a clear continuous range.
  • Restrict unnecessary privileged workloads from using unusually large io_uring mappings until patched.
  • Maintain conservative locked-memory limits for unprivileged users as defense in depth.

Validation and detection

  • Inventory running Linux kernel versions across hosts and container nodes.
  • Check package changelogs or kernel sources for the cited corrective commits.
  • Identify privileged services using io_uring or permitting unusually large registered mappings.
  • Confirm unprivileged locked-memory limits remain substantially below the multi-gigabyte trigger condition.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39793 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-39793Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux087f997870a948820ec366701d178f402c6a23a3, 087f997870a948820ec366701d178f402c6a23a3, 087f997870a948820ec366701d178f402c6a23a3unaffected
LinuxLinux6.14, 0, 6.15.11, 6.16.2, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.