CVE-2026-31774

In the Linux kernel, the following vulnerability has been resolved:

iouring/net: fix slab-out-of-bounds read in iobundle_nbufs()

sqe->len is _u32 but gets stored into sr->len which is int. When userspace passes sqe->len values exceeding INTMAX (e.g. 0xFFFFFFFF), sr->len overflows to a negative value. This negative value propagates through the bundle recv/send path:

1. iorecv(): sel.val = sr->len (ssizet gets -1)
2. iorecvbufselect(): arg.maxlen = sel->val (size_t gets 0xFFFFFFFFFFFFFFFF)
3. ioringbufferspeek(): buf->len is not clamped because maxlen is astronomically large
4. iov[].iovlen = 0xFFFFFFFF flows into iobundle_nbufs()
5. iobundlenbufs(): min_t(int, 0xFFFFFFFF, ret) yields -1, causing ret to increase instead of decrease, creating an infinite loop that reads past the allocated iov[] array

This results in a slab-out-of-bounds read in iobundlenbufs() from the kmalloc-64 slab, as nbufs increments past the allocated iovec entries.

BUG: KASAN: slab-out-of-bounds in iobundlenbufs+0x128/0x160 Read of size 8 at addr ffff888100ae05c8 by task exp/145 Call Trace: iobundlenbufs+0x128/0x160 iorecvfinish+0x117/0xe20 io_recv+0x2db/0x1160

Fix this by rejecting negative sr->len values early in both iosendmsgprep() and iorecvmsgprep(). Since sqe->len is _u32, any value > INTMAX indicates overflow and is not a valid length.