Executive brief
The Linux kernel's io_uring subsystem contains an integer overflow bug in buffer resource handling that can cause the kernel to read and write past the end of an allocated array. This affects systems using gigantic hugetlb pages (16GB or larger), potentially leading to kernel memory corruption and system instability.
Technical details
The vulnerability exists in io_vec_fill_bvec() which computes folio size using a plain int: `unsigned long folio_size = 1 << imu->folio_shift;`. When imu->folio_shift is 32 or larger (possible on 64-bit kernels with gigantic hugetlb pages), shifting int 1 by that amount is undefined behavior. On x86 and arm64, the shift count is taken modulo 32, causing a shift of 34 to yield 4 bytes instead of 16GB. This disagreement between io_estimate_bvec_size() (which uses the correct shift) and io_vec_fill_bvec() (which uses the overflowed value) causes the function to write past the end of the allocated bvec array when processing 1M iovecs on 16G folios. The fix is to use 1UL instead of 1 to ensure proper 64-bit arithmetic, matching the pattern used elsewhere in the same file.
Affected products
- Linux Linux Kernel versions with io_uring/rsrc subsystem using gigantic hugetlb pages (folio_shift >= 32)
Timeline
- 2026-09-04: disclosed