CVE-2026-23067: iommu/io-pgtable-arm: fix size_t signedness bug in unmap path
In the Linux kernel, the following vulnerability has been resolved:
iommu/io-pgtable-arm: fix sizet signedness bug in unmap path
armlpaeunmap() returns sizet but was returning -ENOENT (negative error code) when encountering an unmapped PTE. Since sizet is unsigned, -ENOENT (typically -2) becomes a huge positive value (0xFFFFFFFFFFFFFFFE on 64-bit systems).
This corrupted value propagates through the call chain: armlpaeunmap() returns -ENOENT as sizet -> armlpaeunmappages() returns it -> iommuunmap() adds it to iova address -> iommupgsize() triggers BUGON due to corrupted iova
This can cause IOVA address overflow in iommuunmap() loop and trigger BUGON in iommupgsize() from invalid address alignment.
Fix by returning 0 instead of -ENOENT. The WARNON already signals the error condition, and returning 0 (meaning "nothing unmapped") is the correct semantic for sizet return type. This matches the behavior of other io-pgtable implementations (io-pgtable-arm-v7s, io-pgtable-dart) which return 0 on error conditions.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23067?
The severity of CVE-2026-23067 is classified as high due to the potential for kernel exploitation.
How do I fix CVE-2026-23067?
To fix CVE-2026-23067, update to the patched version of the Linux kernel that addresses the signedness bug in the unmap path.
What systems are affected by CVE-2026-23067?
CVE-2026-23067 affects various versions of the Linux kernel, specifically those using the iommu/io-pgtable-arm module.
What are the potential impacts of CVE-2026-23067?
The potential impacts of CVE-2026-23067 include system crashes and denial of service due to improper error handling in the unmap path.
When was CVE-2026-23067 reported?
CVE-2026-23067 was reported as a vulnerability in the Linux kernel, highlighting a critical issue with error code handling.