CVE-2026-80810 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should assess exposure and verify patch application to prevent potential issues with io_uring/rsrc interactions and large folio sizes. This includes verifying patch application to prevent potential array overflows, assessing exposure to io_uring/rsrc interactions with large folio sizes, validating folio size calculations to prevent segment estimate and fill loop disagreements, and monitoring for potential

Why it matters

Linux kernel maintainers and users should assess exposure and verify patch application to prevent potential issues with io_uring/rsrc interactions and large folio sizes.

• Verify patch application to prevent potential array overflows
• Assess exposure to io_uring/rsrc interactions with large folio sizes
• Validate folio size calculations to prevent segment estimate and fill loop disagreements
• Monitor for potential issues with gigantic hugetlb pages on arm64 and powerpc systems

Technical summary

The io_vec_fill_bvec() function in the Linux kernel's io_uring/rsrc component incorrectly calculates folio size, leading to potential array overflows. This issue requires a folio shift of at least 32, affecting specific architectures like arm64 and powerpc. The io_vec_fill_bvec() function computes the folio size with a plain int 1: unsigned long folio_size = 1 << imu->folio_shift; imu->folio_shift is unsigned int and comes from folio_shift() of the folio backing the registered buffer, so it can be 32 or more on a 64 bit kernel. Shifting int 1 that far is undefined, and on x86 and arm64 the count is taken modulo 32, so a shift of 34 yields 4 rather than 16G. Every other folio_shift shift in this file already

Defensive priority

Linux kernel maintainers and users should assess exposure and verify patch application, prioritizing validation of folio sizes and io_uring/rsrc interactions.

Recommended defensive actions

• Review and apply kernel patches to ensure folio size overflows are handled correctly
• Validate io_uring/rsrc interactions and folio sizes in the Linux kernel
• Monitor for potential segment estimate and fill loop disagreements
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, while source references offer kernel patch information. The issue arises from a folio size overflow in the io_vec_fill_bvec() function, which can lead to a segment estimate and fill loop disagreement. This discrepancy may cause the function to write past the end of the given array and read past the end of imu->bvec. The vulnerability requires a folio with a shift of at least 32, which corresponds to a gigantic hugetlb page. This affects arm64 and powerpc systems with

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.