CVE-2026-80810
Received Received - Intake

Integer Overflow in Linux Kernel io_uring

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() io_vec_fill_bvec() computes the folio size with a plain int 1: unsigned long folio_size = 1 << imu->folio_shift; imu->folio_shift is unsigned int and comes from folio_shift() of the folio backing the registered buffer, so it can be 32 or more on a 64 bit kernel. Shifting int 1 that far is undefined, and on x86 and arm64 the count is taken modulo 32, so a shift of 34 yields 4 rather than 16G. Every other folio_shift shift in this file already uses 1UL. The result is that the segment estimate and the fill loop disagree. io_estimate_bvec_size() sizes the bvec array with the real shift: max_segs += (iov[i].iov_len >> shift) + 2; so a 1M iovec on a 16G folio is charged 2 segments, while io_vec_fill_bvec() then walks the same iovec in folio_size chunks of 4 bytes and writes res_bvec[bvec_idx] a quarter of a million times, past the end of the array it was given. src_bvec is advanced once per iteration as well, so imu->bvec is read past its end at the same time. validate_fixed_range() only checks that the range is inside the registered buffer and does not bound the segment count. Reaching it needs a folio with a shift of at least 32, which means a gigantic hugetlb page: 16G on arm64 with 64K pages, where CONT_PMD_SHIFT is 34 and hugetlb_add_hstate(CONT_PMD_SHIFT - PAGE_SHIFT) registers that size, and likewise on powerpc. x86_64 tops out at 1G, so a shift of 30, which still fits in int and is unaffected. Use 1UL, as the rest of the file does.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80810
EUVD
EUVD-2026-71245

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves an integer overflow in the io_uring subsystem. The issue occurs in io_vec_fill_bvec() where a shift operation on a 32-bit integer causes undefined behavior when folio_shift is 32 or more. This leads to incorrect calculations of folio size, causing the function to write past the end of allocated memory arrays during buffer processing.

Detection Guidance

This vulnerability is specific to the Linux kernel's io_uring subsystem and requires a kernel with folio_shift set to 32 or higher, which is only possible with gigantic hugetlb pages (e.g., 16G on arm64 with 64K pages). Detection involves checking kernel configurations and running specific commands to identify affected systems.

Impact Analysis

This vulnerability could allow local attackers to cause memory corruption, leading to system crashes or potential privilege escalation. The impact requires specific kernel configurations with large folio sizes (16G on arm64 or 1G on x86_64) using hugetlb pages. Exploitation requires local access to trigger the overflow condition.

Mitigation Strategies

Apply the kernel patch that replaces '1 << imu->folio_shift' with '1UL << imu->folio_shift' in io_vec_fill_bvec(). Update to a fixed kernel version. Disable io_uring or hugetlb features if not required. Monitor kernel updates from your distribution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80810. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart