Rik Van Riel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.37 Description: The issue is related to the blk-iocost component in the Linux kernel, where sometimes `iocg->delay` is shifted right by a number that is too large, resulting in undefined behavior on some architectures. This can lead to a shift-out-of-bounds error, as indicated by UBSAN. The error occurs in the `block/blk-iocost.c` file at line 1366. The symptoms of an undefined value delay are not clearly specified, but it is suspected to be annoying to debug. Recommendations: To resolve the issue, update the Linux kernel to version 6.6.37 or later. As a temporary workaround, consider taking the "delay = 0" branch if the shift is too large to avoid undefined behavior.