The io_uring subsystem allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being used in mem_rw when reading /proc/PID/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel.