---
id: CVE-2024-53187
title: 'io_uring: check for overflows in io_pin_pages'
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  io_uring: check for overflows in io_pin_pages


  WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180
  io_uring/memmap.c:144

  CPU: 0 UID: 0 PID: 5834…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e <
    1a0aecabff72a95d240e6d7645949bfe0620dcd7
  - >-
    Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e <
    29eac3eca72d4c2a71122050c37cd7d8f73ac4f3
  - >-
    Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e <
    aaa90844afd499c9142d0199dfda74439314c013
  - >-
    Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e <
    0c0a4eae26ac78379d0c1db053de168a8febc6c9
  - Linux 5.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-10-01T20:04:17.076765Z'
published: '2024-12-27'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:35:34.193Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-53187'
references:
  - url: 'https://git.kernel.org/stable/c/1a0aecabff72a95d240e6d7645949bfe0620dcd7'
  - url: 'https://git.kernel.org/stable/c/29eac3eca72d4c2a71122050c37cd7d8f73ac4f3'
  - url: 'https://git.kernel.org/stable/c/aaa90844afd499c9142d0199dfda74439314c013'
  - url: 'https://git.kernel.org/stable/c/0c0a4eae26ac78379d0c1db053de168a8febc6c9'
tags:
  - cve.org
epss: 0.00282
epssPercentile: 0.20598
ingestedAt: '2026-10-21T12:48:53.725Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

io_uring: check for overflows in io_pin_pages

WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144
CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-next-20241118-syzkaller #0
Call Trace:
 <TASK>
 __io_uaddr_map+0xfb/0x2d0 io_uring/memmap.c:183
 io_rings_map io_uring/io_uring.c:2611 [inline]
 io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470
 io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692
 io_uring_setup io_uring/io_uring.c:3781 [inline]
 ...
 </TASK>

io_pin_pages()'s uaddr parameter came directly from the user and can be
garbage. Don't just add size to it as it can overflow.

## Affected

- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < 1a0aecabff72a95d240e6d7645949bfe0620dcd7`
- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < 29eac3eca72d4c2a71122050c37cd7d8f73ac4f3`
- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < aaa90844afd499c9142d0199dfda74439314c013`
- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < 0c0a4eae26ac78379d0c1db053de168a8febc6c9`
- `Linux 5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.