CVE-2026-23345

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled

When FEAT_LPA2 is enabled, bits 8-9 of the PTE replace the

shareability attribute with bits 50-51 of the output address. The

_PAGE_GCS{,_RO} definitions include the PTE_SHARED bits as 0b11 (this

matches the other _PAGE_* definitions) but using this macro directly

leads to the following panic when enabling GCS on a system/model with

LPA2:

Unable to handle kernel paging request at virtual address fffff1ffc32d8008

Mem abort info:

ESR = 0x0000000096000004

EC = 0x25: DABT (current EL), IL = 32 bits

SET = 0, FnV = 0

EA = 0, S1PTW = 0

FSC = 0x04: level 0 translation fault

Data abort info:

ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000

CM = 0, WnR = 0, TnD = 0, TagAccess = 0

GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0

swapper pgtable: 4k pages, 52-bit VAs, pgdp=0000000060f4d000

[fffff1ffc32d8008] pgd=100000006184

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References