CVE-2026-80810

A flaw was found in the Linux kernel. An integer overflow vulnerability in the io_uring/rsrc component, specifically within the io_vec_fill_bvec() function, can lead to incorrect memory calculations when handling very large memory pages. This error causes the kernel to access memory outside of its intended boundaries, which could result in system instability or a denial of service. A local attacker could potentially leverage this to corrupt kernel memory.

This vulnerability is rated as an Important severity flaw because a local unprivileged attacker could potentially achieve kernel memory corruption, leading to system crashes or local privilege escalation, although exploitation requires highly specific hardware and memory configurations. The defect only triggers on architectures that support gigantic hugetlb folio allocations—specifically 64KB-page ARM64 and PowerPC architectures with multi-gigabyte page sizes—and does not affect standard x86_64 deployments where maximum page shifts remain bounded. Furthermore, the vulnerable code path was introduced in newer kernel releases and is not present in Red Hat Enterprise Linux 7, 8, or 9.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable io_uring system-wide using sysctl to prevent creation and registration of io_uring buffers.

To apply this change immediately on running systems:

sysctl -w kernel.io_uring_disabled=2

To persist this setting across system boots:

echo "kernel.io_uring_disabled = 2" > /etc/sysctl.d/99-disable-io-uring.conf

Caveats: Disabling io_uring will cause services and applications that depend on io_uring asynchronous I/O to fail or fall back to synchronous operations. Active processes with existing io_uring instances must be restarted for the restriction to take full effect. Systems running on x86_64 are not exposed, and on vulnerable architectures, avoiding the allocation of 16GB gigantic hugetlb pages also prevents exposure.