linux-cve-announce - CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2026020423-CVE-2026-23085-14e2@gregkh>
Date: Wed,  4 Feb 2026 17:14:44 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

irqchip/gic-v3-its: Avoid truncating memory addresses

On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem
allocations to be backed by addresses physical memory above the 32-bit
address limit, as found while experimenting with larger VMSPLIT
configurations.

This caused the qemu virt model to crash in the GICv3 driver, which
allocates the 'itt' object using GFP_KERNEL. Since all memory below
the 4GB physical address limit is in ZONE_DMA in this configuration,
kmalloc() defaults to higher addresses for ZONE_NORMAL, and the
ITS driver stores the physical address in a 32-bit 'unsigned long'
variable.

Change the itt_addr variable to the correct phys_addr_t type instead,
along with all other variables in this driver that hold a physical
address.

The gicv5 driver correctly uses u64 variables, while all other irqchip
drivers don't call virt_to_phys or similar interfaces. It's expected that
other device drivers have similar issues, but fixing this one is
sufficient for booting a virtio based guest.

The Linux kernel CVE team has assigned CVE-2026-23085 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 3.19 with commit cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e and fixed in 6.6.122 with commit 1b323391560354d8c515de8658b057a1daa82adb
	Issue introduced in 3.19 with commit cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e and fixed in 6.12.68 with commit 084ba3b99f2dfd991ce7e84fb17117319ec3cd9f
	Issue introduced in 3.19 with commit cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e and fixed in 6.18.8 with commit 03faa61eb4b9ca9aa09bd91d4c3773d8e7b1ac98
	Issue introduced in 3.19 with commit cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e and fixed in 6.19-rc7 with commit 8d76a7d89c12d08382b66e2f21f20d0627d14859

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-23085
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/irqchip/irq-gic-v3-its.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1b323391560354d8c515de8658b057a1daa82adb
	https://git.kernel.org/stable/c/084ba3b99f2dfd991ce7e84fb17117319ec3cd9f
	https://git.kernel.org/stable/c/03faa61eb4b9ca9aa09bd91d4c3773d8e7b1ac98
	https://git.kernel.org/stable/c/8d76a7d89c12d08382b66e2f21f20d0627d14859