A flaw in the Linux kernel io_uring subsystem causes an overflow when calculating the size of a folio backing a registered buffer. The routine uses a signed int shift (1 << imu->folio_shift) that becomes undefined for shifts of 32 or more. On architectures that support hugepages larger than 1 GB, this can produce a erroneously small folio size and cause the code to write far beyond the bounds of the supplied bvec array, corrupting kernel memory. This corruption could allow an attacker with the ability to trigger the write to gain arbitrary kernel execution.

All Linux kernel builds that include the unpatched io_uring implementation are affected. The issue exists in any version before commit c/3267d7c8ba51642117f7bdd1ece02b2540668476 and its subsequent integration commits. Distributions shipping those kernel versions on architectures that support hugepages larger than 1 GB (such as 64‑bit ARM and PowerPC) are susceptible. Standard x86_64 kernels are not affected because the maximum folio shift on that platform is 30.

The vulnerability is not listed in CISA’s KEV catalog and its EPSS score is not available. The CVSS score is not provided, making it difficult to gauge precise severity. The overflow requires the creation of a hugepage buffer with a shift of at least 32, so an attacker would need privileged access or the ability to allocate large hugetlb pages. A successful exploit could result in kernel memory corruption and potential privilege escalation. The risk is moderate to high for affected systems that expose the vulnerable API to privileged or untrusted processes.