Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() io_vec_fill_bvec()… (CVE-2026-80810)

The Linux kernel io_uring subsystem had a vulnerability (CVE-2026-80810) in the io_vec_fill_bvec() function where the folio size was computed using a 32-bit int shift (1 << imu->folio_shift) instead of a 64-bit unsigned long shift (1UL << imu->folio_shift). On 64-bit kernels with folio_shift values of 32 or more, this caused undefined behavior and incorrect segment size calculations. Specifically, on architectures like arm64 and powerpc that support gigantic hugetlb pages (16G or larger), the shift operation wraps modulo 32, resulting in a much smaller folio size than intended. This mismatch causes io_vec_fill_bvec() to write beyond the bounds of the allocated bvec array, leading to out-of-bounds memory writes. The vulnerability does not affect x86_64 systems, which have a maximum folio shift of 30 (1G pages). The fix replaces the int shift with an unsigned long shift (1UL), aligning with the rest of the file and preventing overflow.

This vulnerability can cause out-of-bounds writes in kernel memory when processing very large hugetlb pages on affected architectures (arm64, powerpc). Such memory corruption could potentially lead to system instability or security issues like privilege escalation or denial of service, depending on exploitation context. However, exploitation requires specific conditions including use of gigantic hugetlb pages and is limited to certain architectures. There are no known exploits in the wild.

A fix for this vulnerability has been implemented in the Linux kernel by changing the bit shift operand from int to unsigned long (1UL) in io_vec_fill_bvec(). Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult their Linux distribution or kernel vendor advisories for the availability of the fix.