GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80810 (GCVE-0-2026-80810)

Vulnerability from cvelistv5 – Published: 2026-09-04 15:13 – Updated: 2026-09-04 15:13
VLAI
Title
io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()
Summary
In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() io_vec_fill_bvec() computes the folio size with a plain int 1: unsigned long folio_size = 1 << imu->folio_shift; imu->folio_shift is unsigned int and comes from folio_shift() of the folio backing the registered buffer, so it can be 32 or more on a 64 bit kernel. Shifting int 1 that far is undefined, and on x86 and arm64 the count is taken modulo 32, so a shift of 34 yields 4 rather than 16G. Every other folio_shift shift in this file already uses 1UL. The result is that the segment estimate and the fill loop disagree. io_estimate_bvec_size() sizes the bvec array with the real shift: max_segs += (iov[i].iov_len >> shift) + 2; so a 1M iovec on a 16G folio is charged 2 segments, while io_vec_fill_bvec() then walks the same iovec in folio_size chunks of 4 bytes and writes res_bvec[bvec_idx] a quarter of a million times, past the end of the array it was given. src_bvec is advanced once per iteration as well, so imu->bvec is read past its end at the same time. validate_fixed_range() only checks that the range is inside the registered buffer and does not bound the segment count. Reaching it needs a folio with a shift of at least 32, which means a gigantic hugetlb page: 16G on arm64 with 64K pages, where CONT_PMD_SHIFT is 34 and hugetlb_add_hstate(CONT_PMD_SHIFT - PAGE_SHIFT) registers that size, and likewise on powerpc. x86_64 tops out at 1G, so a shift of 30, which still fits in int and is unaffected. Use 1UL, as the rest of the file does.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 , < 45c945107e007b1fb73e21cd220277652a45521a (git)
Affected: 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 , < 6b308c37fbeba3aa8c634fb1ed53e2f63a5d5a5c (git)
Affected: 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 , < 3267d7c8ba51642117f7bdd1ece02b2540668476 (git)
Affected: 9ef4cbbcb4ac3786a1a4164507511b76b2a572c5 , < 3f3a6a16bbe8bde76532d9415438f8cdef439e5d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.18.47 , ≤ 6.18.* (semver)
Unaffected: 7.1.11 , ≤ 7.1.* (semver)
Unaffected: 7.2.1 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/rsrc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "45c945107e007b1fb73e21cd220277652a45521a",
              "status": "affected",
              "version": "9ef4cbbcb4ac3786a1a4164507511b76b2a572c5",
              "versionType": "git"
            },
            {
              "lessThan": "6b308c37fbeba3aa8c634fb1ed53e2f63a5d5a5c",
              "status": "affected",
              "version": "9ef4cbbcb4ac3786a1a4164507511b76b2a572c5",
              "versionType": "git"
            },
            {
              "lessThan": "3267d7c8ba51642117f7bdd1ece02b2540668476",
              "status": "affected",
              "version": "9ef4cbbcb4ac3786a1a4164507511b76b2a572c5",
              "versionType": "git"
            },
            {
              "lessThan": "3f3a6a16bbe8bde76532d9415438f8cdef439e5d",
              "status": "affected",
              "version": "9ef4cbbcb4ac3786a1a4164507511b76b2a572c5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/rsrc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.47",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()\n\nio_vec_fill_bvec() computes the folio size with a plain int 1:\n\n\tunsigned long folio_size = 1 \u003c\u003c imu-\u003efolio_shift;\n\nimu-\u003efolio_shift is unsigned int and comes from folio_shift() of the\nfolio backing the registered buffer, so it can be 32 or more on a 64 bit\nkernel. Shifting int 1 that far is undefined, and on x86 and arm64 the\ncount is taken modulo 32, so a shift of 34 yields 4 rather than 16G.\nEvery other folio_shift shift in this file already uses 1UL.\n\nThe result is that the segment estimate and the fill loop disagree.\nio_estimate_bvec_size() sizes the bvec array with the real shift:\n\n\tmax_segs += (iov[i].iov_len \u003e\u003e shift) + 2;\n\nso a 1M iovec on a 16G folio is charged 2 segments, while\nio_vec_fill_bvec() then walks the same iovec in folio_size chunks of 4\nbytes and writes res_bvec[bvec_idx] a quarter of a million times, past\nthe end of the array it was given. src_bvec is advanced once per\niteration as well, so imu-\u003ebvec is read past its end at the same time.\nvalidate_fixed_range() only checks that the range is inside the\nregistered buffer and does not bound the segment count.\n\nReaching it needs a folio with a shift of at least 32, which means a\ngigantic hugetlb page: 16G on arm64 with 64K pages, where\nCONT_PMD_SHIFT is 34 and hugetlb_add_hstate(CONT_PMD_SHIFT - PAGE_SHIFT)\nregisters that size, and likewise on powerpc. x86_64 tops out at 1G, so\na shift of 30, which still fits in int and is unaffected.\n\nUse 1UL, as the rest of the file does."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T15:13:30.800Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/45c945107e007b1fb73e21cd220277652a45521a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b308c37fbeba3aa8c634fb1ed53e2f63a5d5a5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3267d7c8ba51642117f7bdd1ece02b2540668476"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f3a6a16bbe8bde76532d9415438f8cdef439e5d"
        }
      ],
      "title": "io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80810",
    "datePublished": "2026-09-04T15:13:30.800Z",
    "dateReserved": "2026-08-26T14:34:25.794Z",
    "dateUpdated": "2026-09-04T15:13:30.800Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80810",
      "date": "2026-09-15",
      "epss": "0.00168",
      "percentile": "0.06376"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80810\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-04T16:18:08.360\",\"lastModified\":\"2026-09-04T16:18:08.360\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()\\n\\nio_vec_fill_bvec() computes the folio size with a plain int 1:\\n\\n\\tunsigned long folio_size = 1 \u003c\u003c imu-\u003efolio_shift;\\n\\nimu-\u003efolio_shift is unsigned int and comes from folio_shift() of the\\nfolio backing the registered buffer, so it can be 32 or more on a 64 bit\\nkernel. Shifting int 1 that far is undefined, and on x86 and arm64 the\\ncount is taken modulo 32, so a shift of 34 yields 4 rather than 16G.\\nEvery other folio_shift shift in this file already uses 1UL.\\n\\nThe result is that the segment estimate and the fill loop disagree.\\nio_estimate_bvec_size() sizes the bvec array with the real shift:\\n\\n\\tmax_segs += (iov[i].iov_len \u003e\u003e shift) + 2;\\n\\nso a 1M iovec on a 16G folio is charged 2 segments, while\\nio_vec_fill_bvec() then walks the same iovec in folio_size chunks of 4\\nbytes and writes res_bvec[bvec_idx] a quarter of a million times, past\\nthe end of the array it was given. src_bvec is advanced once per\\niteration as well, so imu-\u003ebvec is read past its end at the same time.\\nvalidate_fixed_range() only checks that the range is inside the\\nregistered buffer and does not bound the segment count.\\n\\nReaching it needs a folio with a shift of at least 32, which means a\\ngigantic hugetlb page: 16G on arm64 with 64K pages, where\\nCONT_PMD_SHIFT is 34 and hugetlb_add_hstate(CONT_PMD_SHIFT - PAGE_SHIFT)\\nregisters that size, and likewise on powerpc. x86_64 tops out at 1G, so\\na shift of 30, which still fits in int and is unaffected.\\n\\nUse 1UL, as the rest of the file does.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"io_uring/rsrc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9ef4cbbcb4ac3786a1a4164507511b76b2a572c5\",\"lessThan\":\"45c945107e007b1fb73e21cd220277652a45521a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9ef4cbbcb4ac3786a1a4164507511b76b2a572c5\",\"lessThan\":\"6b308c37fbeba3aa8c634fb1ed53e2f63a5d5a5c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9ef4cbbcb4ac3786a1a4164507511b76b2a572c5\",\"lessThan\":\"3267d7c8ba51642117f7bdd1ece02b2540668476\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9ef4cbbcb4ac3786a1a4164507511b76b2a572c5\",\"lessThan\":\"3f3a6a16bbe8bde76532d9415438f8cdef439e5d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"io_uring/rsrc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.47\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.11\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.1\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3267d7c8ba51642117f7bdd1ece02b2540668476\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3f3a6a16bbe8bde76532d9415438f8cdef439e5d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/45c945107e007b1fb73e21cd220277652a45521a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6b308c37fbeba3aa8c634fb1ed53e2f63a5d5a5c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-08T23:58:28Z",
      "cve": "CVE-2026-80810",
      "id": "CVE-2026-80810",
      "initial_release_date": "2026-09-05T00:26:57Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80810",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80810.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.