Physical-memory access via page-count integer overflow

Integer overflow in io_uring memory mapping in Linux kernel 6.14 allows local users to access physical memory through a large region. The memmap allocation shifts the 32-bit mr->nr_pages value before widening it, so a region larger than 4 GB wraps the pages-array size while later code maps the full attacker-selected range. Reachability requires a sufficiently high locked-memory limit or CAP_IPC_LOCK; successful triggering permits physical-memory reads and writes and can crash the host.