CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses
In the Linux kernel, the following vulnerability has been resolved:
irqchip/gic-v3-its: Avoid truncating memory addresses
On 32-bit machines with CONFIGARMLPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while experimenting with larger VMSPLIT configurations.
This caused the qemu virt model to crash in the GICv3 driver, which allocates the 'itt' object using GFPKERNEL. Since all memory below the 4GB physical address limit is in ZONEDMA in this configuration, kmalloc() defaults to higher addresses for ZONENORMAL, and the ITS driver stores the physical address in a 32-bit 'unsigned long' variable.
Change the ittaddr variable to the correct physaddrt type instead, along with all other variables in this driver that hold a physical address.
The gicv5 driver correctly uses u64 variables, while all other irqchip drivers don't call virttophys or similar interfaces. It's expected that other device drivers have similar issues, but fixing this one is sufficient for booting a virtio based guest.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Change the itt_addr variable, along with all other variables in this driver that hold a physical address, from 32-bit unsigned long to phys_addr_t to avoid truncating memory addresses.
Linux kernel irqchip/gic-v3-its driver itt_addr and other physical-address variables = phys_addr_t
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23085?
CVE-2026-23085 has been classified with a medium severity level due to the potential for memory address truncation on affected systems.
How do I fix CVE-2026-23085?
To fix CVE-2026-23085, update the Linux kernel to the latest version that has implemented the patch for this vulnerability.
Which systems are affected by CVE-2026-23085?
CVE-2026-23085 affects devices running the Linux kernel on 32-bit machines with CONFIG_ARM_LPAE enabled.
What are the consequences of not addressing CVE-2026-23085?
Failing to address CVE-2026-23085 may lead to unstable system behavior and potential exploitation due to memory allocation issues.
Is there a workaround for CVE-2026-23085?
Currently, the recommended action for CVE-2026-23085 is to apply the kernel update, as there are no known effective workarounds.