Medium

Linux kernel block-layer folio offset integer overflow

IdentifiersCVE-2025-22122CWE-190

CVE-2025-22122 is an integer-overflow vulnerability in the Linux kernel block layer when adding a folio to a bio. On architectures capable of creating folios larger than 4 GB, such as AArch64 systems supporting 16 GB huge pages, a folio offset can exceed the range of an unsigned int. This can overflow the bio offset handling in bio_add_folio_nofail(), generating warnings and preventing the folio from being added successfully. The upstream fix adjusts the backing page and trims the offset so that bi_offset remains representable.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful triggering causes I/O failure, resulting in a local denial of service with high availability impact. No confidentiality or integrity impact is identified.

Mitigation

If you can’t patch tonight, do this now.

Where immediate patching is not possible, avoid configurations and workloads that create or submit folios larger than 4 GB for block I/O. In particular, disable or avoid use of extremely large huge pages on affected architectures where operationally feasible.

Remediation

Patch, then assume compromise.

Install a Linux kernel update incorporating the fix for CVE-2025-22122 and reboot to run the updated kernel. For Red Hat Enterprise Linux, fixed kernel updates are available for RHEL 9 and RHEL 10; the RHEL 9 kernel-rt fix status was deferred. RHEL 6, 7, and 8 kernel variants listed as unaffected do not contain the vulnerable code.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

LinuxLinux Kerneloperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

redhat accessNews

Jan 1, 2026

RHSA-2025:19105 - Security Advisory - Red Hat Customer Portal

A Linux kernel vulnerability included in the advisory's CVE list; no technical details are provided in the content.

redhat otherNews

Nov 11, 2025

CVE-2025-22122 - Red Hat Customer Portal

A Linux kernel block-layer integer-overflow vulnerability when adding folios larger than 4 GB to a bio. It can cause I/O failure and has a local, low-complexity availability impact for a low-privileged attacker.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1