Linux kernel io_uring: folio shift overflow writes past the bvec array on 16G-hugepage kernels

Impact

io_vec_fill_bvec() computes the folio size as 1 << imu->folio_shift using a plain int, so a shift of 32 or more is undefined and on x86 and arm64 is taken modulo 32 - a shift of 34 yields 4 bytes instead of 16G. The segment estimate uses the real shift, so the two disagree: a 1M iovec on a 16G folio is budgeted 2 segments but the fill loop walks it in 4-byte chunks and writes a quarter of a million entries past the end of the bvec array, reading past imu->bvec at the same time. That is an unprivileged local out-of-bounds write in kernel memory, the standard starting point for privilege escalation on a shared node. Reaching it needs a folio with shift 32 or more, meaning gigantic hugetlb pages: 16G on arm64 with 64K pages, and likewise on powerpc. x86_64 tops out at 1G (shift 30) and is unaffected - but arm64 with 64K pages and gigantic hugepages is exactly the configuration Grace-class GPU nodes and HPC tenants run.

Who can reach it

Local unprivileged user who can call io_uring and register a buffer backed by a gigantic hugetlb page (shift >= 32) - any tenant with a GPU pod on an affected arm64 or powerpc node, if hugetlb of that size is available to them. No x86_64 exposure.

What to do

Apply the stable kernel fix, which uses 1UL as the rest of the file already does. Kernel change: drain and reboot affected arm64/powerpc nodes onto the patched kernel. If you cannot patch immediately, not exposing 16G hugetlb pages to tenants removes the precondition, and x86_64 nodes need no action.

References

Related entries

• Linux kernel io_uring uring_cmd: iovec leak under NVMe passthrough once the alloc cache fillsCVE-2026-80811 · Linux kernel io_uring uring_cmd (async command iovec lifetime)Unscored
• Linux kernel nvmet: NULL dereference when a host issues Identify CNS 07h against an NVMe-oF targetCVE-2026-80813 · Linux kernel nvmet (Identify CNS 07h active namespace list handler)Unscored
• Linux kernel iommufd: NULL dereference racing IOAS change_process against a file-backed mappingCVE-2026-80817 · Linux kernel iommufd (IOAS change_process racing iopt_map_file_pages)Unscored
• Linux kernel tegra241-cmdqv: use-after-free issuing CMD_SYNC on a freed command queue at teardownCVE-2026-80818 · Linux kernel iommu/tegra241-cmdqv (NVIDIA Grace SMMUv3 command-queue virtualization)Unscored
• Linux kernel virtio-crypto: unbounded device-reported result length over-reads guest kernel heapCVE-2026-80836 · Linux kernel virtio-crypto akcipher completion path (virtio_crypto_dataq_akcipher_callback)Unscored
• Linux KVM SEV: sub-page command buffer on SNP hosts triggers RMP faults and host panicCVE-2026-80853 · Linux KVM SEV (temporary buffer for {DE,EN}CRYPT ops on SNP-enabled hosts)Unscored