CVE-2026-23067

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23067", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.954Z", "datePublished": "2026-02-04T16:07:48.457Z", "dateUpdated": "2026-11-05T21:23:16.182Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:59:21.632Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/io-pgtable-arm: fix size_t signedness bug in unmap path\n\n__arm_lpae_unmap() returns size_t but was returning -ENOENT (negative\nerror code) when encountering an unmapped PTE. Since size_t is unsigned,\n-ENOENT (typically -2) becomes a huge positive value (0xFFFFFFFFFFFFFFFE\non 64-bit systems).\n\nThis corrupted value propagates through the call chain:\n __arm_lpae_unmap() returns -ENOENT as size_t\n -> arm_lpae_unmap_pages() returns it\n -> __iommu_unmap() adds it to iova address\n -> iommu_pgsize() triggers BUG_ON due to corrupted iova\n\nThis can cause IOVA address overflow in __iommu_unmap() loop and\ntrigger BUG_ON in iommu_pgsize() from invalid address alignment.\n\nFix by returning 0 instead of -ENOENT. The WARN_ON already signals\nthe error condition, and returning 0 (meaning \"nothing unmapped\")\nis the correct semantic for size_t return type. This matches the\nbehavior of other io-pgtable implementations (io-pgtable-arm-v7s,\nio-pgtable-dart) which return 0 on error conditions."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/io-pgtable-arm.c"], "versions": [{"version": "3318f7b5cefbff96b1bb49584ac38d2c9997a830", "lessThan": "41ec6988547819756fb65e94fc24f3e0dddf84ac", "status": "affected", "versionType": "git"}, {"version": "3318f7b5cefbff96b1bb49584ac38d2c9997a830", "lessThan": "374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/io-pgtable-arm.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.8", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/41ec6988547819756fb65e94fc24f3e0dddf84ac"}, {"url": "https://git.kernel.org/stable/c/374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8"}], "title": "iommu/io-pgtable-arm: fix size_t signedness bug in unmap path", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23067", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:19:04.606718Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:23:16.182Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23067", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:19:04.606718Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:19:05.783Z"}}], "cna": {"title": "iommu/io-pgtable-arm: fix size_t signedness bug in unmap path", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3318f7b5cefbff96b1bb49584ac38d2c9997a830", "lessThan": "41ec6988547819756fb65e94fc24f3e0dddf84ac", "versionType": "git"}, {"status": "affected", "version": "3318f7b5cefbff96b1bb49584ac38d2c9997a830", "lessThan": "374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8", "versionType": "git"}], "programFiles": ["drivers/iommu/io-pgtable-arm.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.8", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/iommu/io-pgtable-arm.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/41ec6988547819756fb65e94fc24f3e0dddf84ac"}, {"url": "https://git.kernel.org/stable/c/374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/io-pgtable-arm: fix size_t signedness bug in unmap path\n\n__arm_lpae_unmap() returns size_t but was returning -ENOENT (negative\nerror code) when encountering an unmapped PTE. Since size_t is unsigned,\n-ENOENT (typically -2) becomes a huge positive value (0xFFFFFFFFFFFFFFFE\non 64-bit systems).\n\nThis corrupted value propagates through the call chain:\n __arm_lpae_unmap() returns -ENOENT as size_t\n -> arm_lpae_unmap_pages() returns it\n -> __iommu_unmap() adds it to iova address\n -> iommu_pgsize() triggers BUG_ON due to corrupted iova\n\nThis can cause IOVA address overflow in __iommu_unmap() loop and\ntrigger BUG_ON in iommu_pgsize() from invalid address alignment.\n\nFix by returning 0 instead of -ENOENT. The WARN_ON already signals\nthe error condition, and returning 0 (meaning \"nothing unmapped\")\nis the correct semantic for size_t return type. This matches the\nbehavior of other io-pgtable implementations (io-pgtable-arm-v7s,\nio-pgtable-dart) which return 0 on error conditions."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.8", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19", "versionStartIncluding": "6.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:59:21.632Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23067", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:23:16.182Z", "dateReserved": "2026-01-13T15:37:45.954Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-02-04T16:07:48.457Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iommu/io-pgtable-arm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "41ec6988547819756fb65e94fc24f3e0dddf84ac", "status": "affected", "version": "3318f7b5cefbff96b1bb49584ac38d2c9997a830", "versionType": "git"}, {"lessThan": "374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8", "status": "affected", "version": "3318f7b5cefbff96b1bb49584ac38d2c9997a830", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iommu/io-pgtable-arm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "467E1359-7F6A-4790-AC45-172024944460", "versionEndExcluding": "6.18.8", "versionStartIncluding": "6.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/io-pgtable-arm: fix size_t signedness bug in unmap path\n\n__arm_lpae_unmap() returns size_t but was returning -ENOENT (negative\nerror code) when encountering an unmapped PTE. Since size_t is unsigned,\n-ENOENT (typically -2) becomes a huge positive value (0xFFFFFFFFFFFFFFFE\non 64-bit systems).\n\nThis corrupted value propagates through the call chain:\n __arm_lpae_unmap() returns -ENOENT as size_t\n -> arm_lpae_unmap_pages() returns it\n -> __iommu_unmap() adds it to iova address\n -> iommu_pgsize() triggers BUG_ON due to corrupted iova\n\nThis can cause IOVA address overflow in __iommu_unmap() loop and\ntrigger BUG_ON in iommu_pgsize() from invalid address alignment.\n\nFix by returning 0 instead of -ENOENT. The WARN_ON already signals\nthe error condition, and returning 0 (meaning \"nothing unmapped\")\nis the correct semantic for size_t return type. This matches the\nbehavior of other io-pgtable implementations (io-pgtable-arm-v7s,\nio-pgtable-dart) which return 0 on error conditions."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niommu/io-pgtable-arm: correcci\u00f3n de error de signo de size_t en la ruta de desmapeo\n\n__arm_lpae_unmap() devuelve size_t pero estaba devolviendo -ENOENT (c\u00f3digo de error negativo) al encontrar una PTE no mapeada. Dado que size_t no tiene signo, -ENOENT (t\u00edpicamente -2) se convierte en un valor positivo enorme (0xFFFFFFFFFFFFFFFE en sistemas de 64 bits).\n\nEste valor corrupto se propaga a trav\u00e9s de la cadena de llamadas:\n __arm_lpae_unmap() devuelve -ENOENT como size_t\n -> arm_lpae_unmap_pages() lo devuelve\n -> __iommu_unmap() lo a\u00f1ade a la direcci\u00f3n iova\n -> iommu_pgsize() activa BUG_ON debido a iova corrupta\n\nEsto puede causar un desbordamiento de direcci\u00f3n IOVA en el bucle de __iommu_unmap() y activar BUG_ON en iommu_pgsize() por una alineaci\u00f3n de direcci\u00f3n inv\u00e1lida.\n\nSe corrige devolviendo 0 en lugar de -ENOENT. El WARN_ON ya se\u00f1ala la condici\u00f3n de error, y devolver 0 (que significa 'nada desmapeado') es la sem\u00e1ntica correcta para el tipo de retorno size_t. Esto coincide con el comportamiento de otras implementaciones de io-pgtable (io-pgtable-arm-v7s, io-pgtable-dart) que devuelven 0 en condiciones de error."}], "id": "CVE-2026-23067", "lastModified": "2026-11-05T22:18:01.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23067", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:19:04.606718Z", "version": "2.0.3"}}]}, "published": "2026-02-04T17:16:17.403", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/41ec6988547819756fb65e94fc24f3e0dddf84ac"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: iommu/io-pgtable-arm: fix size_t signedness bug in unmap path", "id": "2436817", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436817"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-23067", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23067\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23067\nhttps://lore.kernel.org/linux-cve-announce/2026020417-CVE-2026-23067-b41f@gregkh/T"], "threat_severity": "Low"}

{"analysis": {"en": {"generated_at": "2026-04-18T18:29:47.758873+00:00", "value": {"mitigation_remediation": ["Apply the official kernel patch that changes __arm_lpae_unmap to return\u202f0 instead of\u202f\u2013ENOENT when unmapping fails.", "Upgrade the system to a kernel version that includes this fix, such as any release released after the patch commit, or any newer stable release that incorporates the change.", "Re\u2011compile and reinstall any custom kernel modules or drivers that interact with the IOMMU subsystem to ensure they link against the updated code."], "summary": {"action": "Patch", "impact": "Denial of Service via kernel crash"}, "threat_synthesis": {"affected_systems": "All Linux kernels built from the 6.19 source tree before the patch are vulnerable. This includes the 6.19 release candidates up to rc6 and any distribution kernel that has not integrated the fix. The issue applies to the iommu/io\u2011pgtable\u2011arm implementation on those kernels.", "description_and_impact": "The flaw occurs when the ARM LPAE unmap routine returns a signed error value through a size_t return type, causing the negative value to be interpreted as a huge unsigned number. This corrupted value propagates through the call chain, eventually producing a mis\u2011aligned address that triggers a BUG_ON and leads to a kernel panic. The weakness is identified as CWE\u2011617: Incorrect Check or Handling of Error Condition. The description does not indicate a pathway to arbitrary code execution or privilege escalation.", "risk_and_exploitability": "The CVSS score of 5.5 classifies the item as moderate severity while the EPSS score of less than\u202f1\u202f% indicates a very low probability of exploitation. Based on the description, it is inferred that the bug requires interaction with the IOMMU subsystem, which is normally limited to privileged kernel code or device drivers, making remote exploitation unlikely. Nonetheless, any legitimate driver that invokes unmap on an unmapped page table entry can immediately trigger a kernel panic. The vulnerability is not listed in CISA\u2019s KEV catalog, so no known active exploits exist at present."}}}}, "created": "2026-04-18T18:30:07.294001+00:00", "updated": "2026-04-18T18:30:07.294012+00:00", "vendors": []}