CVE-2026-80810

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()

io_vec_fill_bvec() computes the folio size with a plain int 1:

unsigned long folio_size = 1 << imu->folio_shift;

imu->folio_shift is unsigned int and comes from folio_shift() of the

folio backing the registered buffer, so it can be 32 or more on a 64 bit

kernel. Shifting int 1 that far is undefined, and on x86 and arm64 the

count is taken modulo 32, so a shift of 34 yields 4 rather than 16G.

Every other folio_shift shift in this file already uses 1UL.

The result is that the segment estimate and the fill loop disagree.

io_estimate_bvec_size() sizes the bvec array with the real shift:

max_segs += (iov[i].iov_len >> shift) + 2;

so a 1M iovec on a 16G folio is charged 2 segments, while

io_vec_fill_bvec() then walks the same iovec in folio_size chunks of 4

bytes and writes res_bvec[bvec_idx] a quarter of a million times, past

the end of the array it was g

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References