diff --git a/fs/file.c b/fs/file.c
index 24e9227dee1e..aa4ab548e917 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -669,6 +669,7 @@ static struct file *pick_file(struct files_struct *files, unsigned fd)
 		file = ERR_PTR(-EINVAL);
 		goto out_unlock;
 	}
+	fd = array_index_nospec(fd, fdt->max_fds);
 	file = fdt->fd[fd];
 	if (!file) {
 		file = ERR_PTR(-EBADF);