From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 377B0472F82 for ; Fri, 4 Sep 2026 15:18:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788535108; cv=none; b=qC54HxbKvDdBHgKwGquBPGATU1y9YJNPyFD0YlStwQqrLfLFPDHFykhB0Oy+UR7Ygd9om4M9NvHTQzy0x3L7GG/Dba1H59MJbIA/Qv4N6hpHlQV2DyQtWRZX4yIXVAj8Jc7NJCz3l0RtVGUKCnMIHJKrlKa35tyPAoFT72Sldgg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788535108; c=relaxed/simple; bh=m6oKb7b7NSR+ljcoUhrtlBHZP/r6j4YUu2yAwAFSTaA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ac8jYl8QrIAhee4sCX1sNTBZw6MetEbFDggxideDlrSV+S9vtxxbsyc7SzZXhVNrpo6QbeIdmG8QnucQmtvbAW49OQ21DARJIuGzQYlhx/YkW13jLxqjQfnlk2wsgz1rZxfjoGUGYI4sT9TdkmZe3K/2YDxbMcjsrvl5r89PUXA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lkc/nSyF; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="lkc/nSyF" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 436101F00A3D; Fri, 4 Sep 2026 15:18:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788535107; bh=hePf25WIKyvFaHzUlTRqz/lpTMLhIVEnSR2iaSkBCQo=; h=From:To:Cc:Subject:Date:Reply-To; b=lkc/nSyFhD4ebwExCGB0BP8Hv5FV4xXt95sdvHDSGTF4zCEb0AYqmk7mkQtVCGv6G dg7dcmffD46qBTqZb2g0C3XIT5ZdWjTNt2MmqJxyRG1U61tX1mjI9n7ste0PqYvG7U cnb3KOVNi03ltD6eEWKq3wVME0K2XhViag+buRAY= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-80810: io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() Date: Fri, 4 Sep 2026 17:11:49 +0200 Message-ID: <2026090411-CVE-2026-80810-e7ad@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3713; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=JzaLDaDt0vOFIFFDFZRFK93l227nFP8ZkOcBsVMD0qk=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmz7vf/TNNcVMxcaM70d2bQjDa13Xxl0UkPWC/J3DpRY 27hxLa0I5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACaybz7DglmHtp0KNHs7L7LA K4Ar+DFLYKroBIa5UmzvNjtdMdvZ6Nc6bcIbpvNq5RvYAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() io_vec_fill_bvec() computes the folio size with a plain int 1: unsigned long folio_size = 1 << imu->folio_shift; imu->folio_shift is unsigned int and comes from folio_shift() of the folio backing the registered buffer, so it can be 32 or more on a 64 bit kernel. Shifting int 1 that far is undefined, and on x86 and arm64 the count is taken modulo 32, so a shift of 34 yields 4 rather than 16G. Every other folio_shift shift in this file already uses 1UL. The result is that the segment estimate and the fill loop disagree. io_estimate_bvec_size() sizes the bvec array with the real shift: max_segs += (iov[i].iov_len >> shift) + 2; so a 1M iovec on a 16G folio is charged 2 segments, while io_vec_fill_bvec() then walks the same iovec in folio_size chunks of 4 bytes and writes res_bvec[bvec_idx] a quarter of a million times, past the end of the array it was given. src_bvec is advanced once per iteration as well, so imu->bvec is read past its end at the same time. validate_fixed_range() only checks that the range is inside the registered buffer and does not bound the segment count. Reaching it needs a folio with a shift of at least 32, which means a gigantic hugetlb page: 16G on arm64 with 64K pages, where CONT_PMD_SHIFT is 34 and hugetlb_add_hstate(CONT_PMD_SHIFT - PAGE_SHIFT) registers that size, and likewise on powerpc. x86_64 tops out at 1G, so a shift of 30, which still fits in int and is unaffected. Use 1UL, as the rest of the file does. The Linux kernel CVE team has assigned CVE-2026-80810 to this issue. Affected and fixed versions =========================== Issue introduced in 6.15 with commit 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 and fixed in 6.18.47 with commit 45c945107e007b1fb73e21cd220277652a45521a Issue introduced in 6.15 with commit 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 and fixed in 7.1.11 with commit 6b308c37fbeba3aa8c634fb1ed53e2f63a5d5a5c Issue introduced in 6.15 with commit 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 and fixed in 7.2.1 with commit 3267d7c8ba51642117f7bdd1ece02b2540668476 Issue introduced in 6.15 with commit 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 and fixed in 7.3-rc1 with commit 3f3a6a16bbe8bde76532d9415438f8cdef439e5d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-80810 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: io_uring/rsrc.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/45c945107e007b1fb73e21cd220277652a45521a https://git.kernel.org/stable/c/6b308c37fbeba3aa8c634fb1ed53e2f63a5d5a5c https://git.kernel.org/stable/c/3267d7c8ba51642117f7bdd1ece02b2540668476 https://git.kernel.org/stable/c/3f3a6a16bbe8bde76532d9415438f8cdef439e5d