CVE-2026-23085

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

irqchip/gic-v3-its: Avoid truncating memory addresses

On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem

allocations to be backed by addresses physical memory above the 32-bit

address limit, as found while experimenting with larger VMSPLIT

configurations.

This caused the qemu virt model to crash in the GICv3 driver, which

allocates the 'itt' object using GFP_KERNEL. Since all memory below

the 4GB physical address limit is in ZONE_DMA in this configuration,

kmalloc() defaults to higher addresses for ZONE_NORMAL, and the

ITS driver stores the physical address in a 32-bit 'unsigned long'

variable.

Change the itt_addr variable to the correct phys_addr_t type instead,

along with all other variables in this driver that hold a physical

address.

The gicv5 driver correctly uses u64 variables, while all other irqchip

drivers don't call virt_to_phys or similar interfaces. It's expected that

other device drive

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References