Critical Memory Allocation Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-39756: In the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by syste... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and security features. However, a recent vulnerability has been identified that affects the file descriptor table allocations, potentially leading to excessive memory usage and system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been discovered that allows processes to trigger massive memory allocation attempts exceeding INT_MAX when the sysctl_nr_open value is set to a very high number. This can lead to system warnings and impractical memory allocation requests, causing potential system crashes or degraded performance. The issue arises when the kernel's allocation functions do not properly enforce limits on memory requests, particularly when high file descriptor limits are set by systemd.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can lower the value of /proc/sys/fs/nr_open to avoid triggering the excessive memory allocation. For example, you can set it to a lower value using the command: echo 1048576 > /proc/sys/fs/nr_open
Conclusion
The identified vulnerability in the Linux kernel poses significant risks related to memory allocation and system stability. It is essential for users of affected Debian packages to apply the recommended updates or workarounds to mitigate potential impacts. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to excessive memory allocation requests, resulting in system warnings, crashes, or degraded performance.
You can use the Vulert platform to monitor and alert for vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Debian 11, 12, 13, and 14 are affected, with specific fixed versions available for Debian 13 and 14.
Yes, updating to the patched versions of the Linux package is the permanent fix for this vulnerability.
If immediate updates are not possible, consider applying the workaround by lowering the nr_open value to prevent triggering the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
