CVE-2026-80810: io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()

CVE-2026-80810: io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()

io_vec_fill_bvec() computes the folio size with a plain int 1:

	unsigned long folio_size = 1 << imu->folio_shift;

imu->folio_shift is unsigned int and comes from folio_shift() of the
folio backing the registered buffer, so it can be 32 or more on a 64 bit
kernel. Shifting int 1 that far is undefined, and on x86 and arm64 the
count is taken modulo 32, so a shift of 34 yields 4 rather than 16G.
Every other folio_shift shift in this file already uses 1UL.

The result is that the segment estimate and the fill loop disagree.
io_estimate_bvec_size() sizes the bvec array with the real shift:

	max_segs += (iov[i].iov_len >> shift) + 2;

so a 1M iovec on a 16G folio is charged 2 segments, while
io_vec_fill_bvec() then walks the same iovec in folio_size chunks of 4
bytes and writes res_bvec[bvec_idx] a quarter of a million times, past
the end of the array it was given. src_bvec is advanced once per
iteration as well, so imu->bvec is read past its end at the same time.
validate_fixed_range() only checks that the range is inside the
registered buffer and does not bound the segment count.

Reaching it needs a folio with a shift of at least 32, which means a
gigantic hugetlb page: 16G on arm64 with 64K pages, where
CONT_PMD_SHIFT is 34 and hugetlb_add_hstate(CONT_PMD_SHIFT - PAGE_SHIFT)
registers that size, and likewise on powerpc. x86_64 tops out at 1G, so
a shift of 30, which still fits in int and is unaffected.

Use 1UL, as the rest of the file does.

The Linux kernel CVE team has assigned CVE-2026-80810 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.15 with commit 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 and fixed in 6.18.47 with commit 45c945107e007b1fb73e21cd220277652a45521a
	Issue introduced in 6.15 with commit 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 and fixed in 7.1.11 with commit 6b308c37fbeba3aa8c634fb1ed53e2f63a5d5a5c
	Issue introduced in 6.15 with commit 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 and fixed in 7.2.1 with commit 3267d7c8ba51642117f7bdd1ece02b2540668476
	Issue introduced in 6.15 with commit 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 and fixed in 7.3-rc1 with commit 3f3a6a16bbe8bde76532d9415438f8cdef439e5d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-80810
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	io_uring/rsrc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/45c945107e007b1fb73e21cd220277652a45521a
	https://git.kernel.org/stable/c/6b308c37fbeba3aa8c634fb1ed53e2f63a5d5a5c
	https://git.kernel.org/stable/c/3267d7c8ba51642117f7bdd1ece02b2540668476
	https://git.kernel.org/stable/c/3f3a6a16bbe8bde76532d9415438f8cdef439e5d