CVE-2026-23085

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23085
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Avoid truncating memory addresses On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while experimenting with larger VMSPLIT configurations. This caused the qemu virt model to crash in the GICv3 driver, which allocates the 'itt' object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses for ZONE_NORMAL, and the ITS driver stores the physical address in a 32-bit 'unsigned long' variable. Change the itt_addr variable to the correct phys_addr_t type instead, along with all other variables in this driver that hold a physical address. The gicv5 driver correctly uses u64 variables, while all other irqchip drivers don't call virt_to_phys or similar interfaces. It's expected that other device drivers have similar issues, but fixing this one is sufficient for booting a virtio based guest.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/03faa61eb4b9ca9aa09bd91d4c3773d8e7b1ac98 Patch
https://git.kernel.org/stable/c/084ba3b99f2dfd991ce7e84fb17117319ec3cd9f Patch
https://git.kernel.org/stable/c/1b323391560354d8c515de8658b057a1daa82adb Patch
https://git.kernel.org/stable/c/85215d633983233809f7d4dad163b953331b8238 Patch
https://git.kernel.org/stable/c/8d76a7d89c12d08382b66e2f21f20d0627d14859 Patch
https://git.kernel.org/stable/c/e2f9c751f73a2d5bb62d94ab030aec118a811f27 Patch
https://git.kernel.org/stable/c/e332b3b69e5b3acf07204a4b185071bab15c2b88 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
History

17 Mar 2026, 21:10

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: irqchip/gic-v3-its: Evitar la truncación de direcciones de memoria En máquinas de 32 bits con CONFIG_ARM_LPAE, es posible que las asignaciones de memoria baja estén respaldadas por direcciones de memoria física por encima del límite de direcciones de 32 bits, como se descubrió al experimentar con configuraciones VMSPLIT más grandes. Esto causó que el modelo virt de qemu colapsara en el controlador GICv3, que asigna el objeto 'itt' usando GFP_KERNEL. Dado que toda la memoria por debajo del límite de direcciones físicas de 4 GB está en ZONE_DMA en esta configuración, kmalloc() por defecto utiliza direcciones más altas para ZONE_NORMAL, y el controlador ITS almacena la dirección física en una variable 'unsigned long' de 32 bits. Cambiar la variable itt_addr al tipo correcto phys_addr_t en su lugar, junto con todas las demás variables en este controlador que contienen una dirección física. El controlador gicv5 utiliza correctamente variables u64, mientras que todos los demás controladores irqchip no llaman a virt_to_phys o interfaces similares. Se espera que otros controladores de dispositivos tengan problemas similares, pero solucionar este es suficiente para arrancar un invitado basado en virtio.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/03faa61eb4b9ca9aa09bd91d4c3773d8e7b1ac98 - () https://git.kernel.org/stable/c/03faa61eb4b9ca9aa09bd91d4c3773d8e7b1ac98 - Patch
References () https://git.kernel.org/stable/c/084ba3b99f2dfd991ce7e84fb17117319ec3cd9f - () https://git.kernel.org/stable/c/084ba3b99f2dfd991ce7e84fb17117319ec3cd9f - Patch
References () https://git.kernel.org/stable/c/1b323391560354d8c515de8658b057a1daa82adb - () https://git.kernel.org/stable/c/1b323391560354d8c515de8658b057a1daa82adb - Patch
References () https://git.kernel.org/stable/c/85215d633983233809f7d4dad163b953331b8238 - () https://git.kernel.org/stable/c/85215d633983233809f7d4dad163b953331b8238 - Patch
References () https://git.kernel.org/stable/c/8d76a7d89c12d08382b66e2f21f20d0627d14859 - () https://git.kernel.org/stable/c/8d76a7d89c12d08382b66e2f21f20d0627d14859 - Patch
References () https://git.kernel.org/stable/c/e2f9c751f73a2d5bb62d94ab030aec118a811f27 - () https://git.kernel.org/stable/c/e2f9c751f73a2d5bb62d94ab030aec118a811f27 - Patch
References () https://git.kernel.org/stable/c/e332b3b69e5b3acf07204a4b185071bab15c2b88 - () https://git.kernel.org/stable/c/e332b3b69e5b3acf07204a4b185071bab15c2b88 - Patch

06 Feb 2026, 17:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/85215d633983233809f7d4dad163b953331b8238 -
  • () https://git.kernel.org/stable/c/e2f9c751f73a2d5bb62d94ab030aec118a811f27 -
  • () https://git.kernel.org/stable/c/e332b3b69e5b3acf07204a4b185071bab15c2b88 -

04 Feb 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-04 17:16

Updated : 2026-03-17 21:10

NVD link : CVE-2026-23085

Mitre link : CVE-2026-23085

CVE.ORG link : CVE-2026-23085

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo