CVE-2025-39756

A flaw was found in the Linux kernel. A local user can exploit this by configuring the sysctl_nr_open parameter to a very high value and then attempting to use a high file descriptor number. This action triggers an attempt to allocate an extremely large file descriptor table, which exceeds the system's maximum integer (INT_MAX) limit for memory allocation. The consequence is a kernel warning and a failed, impractical memory allocation, potentially leading to a Denial of Service (DoS) due to resource exhaustion.

A flaw in the Linux kernel could lead to uncontrolled resource consumption when a process attempts to use file descriptors near an extremely high fs.nr_open limit, causing massive fdtable allocation attempts and kernel warnings/failures. A local attacker can trigger this by invoking operations like dup2() with a very large target FD when the system/user limits allow it, resulting in a denial of service via memory pressure or repeated failed allocations. PR is set to Low because reaching the vulnerable path typically depends on elevated/system-level configuration of very large FD limits (and/or the ability to raise RLIMIT_NOFILE) rather than a default unprivileged setup.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.