CVE-2025-39756
Description
A flaw was found in the Linux kernel. A local user can exploit this by configuring the sysctl_nr_open parameter to a very high value and then attempting to use a high file descriptor number. This action triggers an attempt to allocate an extremely large file descriptor table, which exceeds the system's maximum integer (INT_MAX) limit for memory allocation. The consequence is a kernel warning and a failed, impractical memory allocation, potentially leading to a Denial of Service (DoS) due to resource exhaustion.
Statement
A flaw in the Linux kernel could lead to uncontrolled resource consumption when a process attempts to use file descriptors near an extremely high fs.nr_open limit, causing massive fdtable allocation attempts and kernel warnings/failures. A local attacker can trigger this by invoking operations like dup2() with a very large target FD when the system/user limits allow it, resulting in a denial of service via memory pressure or repeated failed allocations. PR is set to Low because reaching the vulnerable path typically depends on elevated/system-level configuration of very large FD limits (and/or the ability to raise RLIMIT_NOFILE) rather than a default unprivileged setup.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Application Data; Modify Application Data; Read Files or Directories; Modify Files or Directories
An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
