{"id":"CVE-2026-23085","title":"irqchip/gic-v3-its: Avoid truncating memory addresses","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v3-its: Avoid truncating memory addresses\n\nOn 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem\nallocations to be backed by addresses physical…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < e332b3b69e5b3acf07204a4b185071bab15c2b88","Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < e2f9c751f73a2d5bb62d94ab030aec118a811f27","Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < 85215d633983233809f7d4dad163b953331b8238","Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < 1b323391560354d8c515de8658b057a1daa82adb","Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < 084ba3b99f2dfd991ce7e84fb17117319ec3cd9f","Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < 03faa61eb4b9ca9aa09bd91d4c3773d8e7b1ac98","Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < 8d76a7d89c12d08382b66e2f21f20d0627d14859","Linux 3.19"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-10T20:40:42.445145Z"},"published":"2026-02-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T18:25:29.916Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23085","references":[{"url":"https://git.kernel.org/stable/c/e332b3b69e5b3acf07204a4b185071bab15c2b88"},{"url":"https://git.kernel.org/stable/c/e2f9c751f73a2d5bb62d94ab030aec118a811f27"},{"url":"https://git.kernel.org/stable/c/85215d633983233809f7d4dad163b953331b8238"},{"url":"https://git.kernel.org/stable/c/1b323391560354d8c515de8658b057a1daa82adb"},{"url":"https://git.kernel.org/stable/c/084ba3b99f2dfd991ce7e84fb17117319ec3cd9f"},{"url":"https://git.kernel.org/stable/c/03faa61eb4b9ca9aa09bd91d4c3773d8e7b1ac98"},{"url":"https://git.kernel.org/stable/c/8d76a7d89c12d08382b66e2f21f20d0627d14859"}],"tags":["cve.org"],"epss":0.00143,"epssPercentile":0.03275,"ingestedAt":"2026-10-19T18:35:50.106Z","slug":"CVE-2026-23085","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v3-its: Avoid truncating memory addresses\n\nOn 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem\nallocations to be backed by addresses physical memory above the 32-bit\naddress limit, as found while experimenting with larger VMSPLIT\nconfigurations.\n\nThis caused the qemu virt model to crash in the GICv3 driver, which\nallocates the 'itt' object using GFP_KERNEL. Since all memory below\nthe 4GB physical address limit is in ZONE_DMA in this configuration,\nkmalloc() defaults to higher addresses for ZONE_NORMAL, and the\nITS driver stores the physical address in a 32-bit 'unsigned long'\nvariable.\n\nChange the itt_addr variable to the correct phys_addr_t type instead,\nalong with all other variables in this driver that hold a physical\naddress.\n\nThe gicv5 driver correctly uses u64 variables, while all other irqchip\ndrivers don't call virt_to_phys or similar interfaces. It's expected that\nother device drivers have similar issues, but fixing this one is\nsufficient for booting a virtio based guest.\n\n## Affected\n\n- `Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < e332b3b69e5b3acf07204a4b185071bab15c2b88`\n- `Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < e2f9c751f73a2d5bb62d94ab030aec118a811f27`\n- `Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < 85215d633983233809f7d4dad163b953331b8238`\n- `Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < 1b323391560354d8c515de8658b057a1daa82adb`\n- `Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < 084ba3b99f2dfd991ce7e84fb17117319ec3cd9f`\n- `Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < 03faa61eb4b9ca9aa09bd91d4c3773d8e7b1ac98`\n- `Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < 8d76a7d89c12d08382b66e2f21f20d0627d14859`\n- `Linux 3.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}