Re: [BUG] io_uring: possible CQE32 overflow flush inconsistency in __io_cqring_overflow_flush()

[gregkh@xxxxxxxxxxxxxxxxxxx]

On Sat, Jun 20, 2026 at 06:13:50AM +0000, Cyber_black wrote:
> 
> 
> Hi Gabriel,
> 
> Thank you for your response.
> 
> I found this bug while doing independent research. I was reading the Linux kernel code from Linus Torvalds' main repository (git.kernel.org) and the io_uring subsystem caught my attention. In particular, the use of shared memory for optimization purposes stood out – especially since this very feature has been exploited in the past to develop rootkits targeting io_uring.
> 
> So I first studied its architecture and then read the code in depth. The bug emerged during that review.
> 
> Regarding a trigger scenario (PoC – Proof of Concept): unfortunately, I don't have one. My system does not support io_uring (it returns ENOSYS, likely due to enterprise compatibility settings), so I couldn't run the liburing test suite. However, the fix itself is straightforward and the logic is clear.

That's not how any of this works, please always test your changes.  If
you can't even build/boot them, don't expect others to do it for you.

thanks,

greg k-h