---
id: CVE-2026-23085
title: 'irqchip/gic-v3-its: Avoid truncating memory addresses'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  irqchip/gic-v3-its: Avoid truncating memory addresses

  On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem
  allocations to be backed by addresses physical…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e <
    e332b3b69e5b3acf07204a4b185071bab15c2b88
  - >-
    Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e <
    e2f9c751f73a2d5bb62d94ab030aec118a811f27
  - >-
    Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e <
    85215d633983233809f7d4dad163b953331b8238
  - >-
    Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e <
    1b323391560354d8c515de8658b057a1daa82adb
  - >-
    Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e <
    084ba3b99f2dfd991ce7e84fb17117319ec3cd9f
  - >-
    Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e <
    03faa61eb4b9ca9aa09bd91d4c3773d8e7b1ac98
  - >-
    Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e <
    8d76a7d89c12d08382b66e2f21f20d0627d14859
  - Linux 3.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-10T20:40:42.445145Z'
published: '2026-02-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:25:29.916Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23085'
references:
  - url: 'https://git.kernel.org/stable/c/e332b3b69e5b3acf07204a4b185071bab15c2b88'
  - url: 'https://git.kernel.org/stable/c/e2f9c751f73a2d5bb62d94ab030aec118a811f27'
  - url: 'https://git.kernel.org/stable/c/85215d633983233809f7d4dad163b953331b8238'
  - url: 'https://git.kernel.org/stable/c/1b323391560354d8c515de8658b057a1daa82adb'
  - url: 'https://git.kernel.org/stable/c/084ba3b99f2dfd991ce7e84fb17117319ec3cd9f'
  - url: 'https://git.kernel.org/stable/c/03faa61eb4b9ca9aa09bd91d4c3773d8e7b1ac98'
  - url: 'https://git.kernel.org/stable/c/8d76a7d89c12d08382b66e2f21f20d0627d14859'
tags:
  - cve.org
epss: 0.00143
epssPercentile: 0.03275
ingestedAt: '2026-10-19T18:35:50.106Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

irqchip/gic-v3-its: Avoid truncating memory addresses

On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem
allocations to be backed by addresses physical memory above the 32-bit
address limit, as found while experimenting with larger VMSPLIT
configurations.

This caused the qemu virt model to crash in the GICv3 driver, which
allocates the 'itt' object using GFP_KERNEL. Since all memory below
the 4GB physical address limit is in ZONE_DMA in this configuration,
kmalloc() defaults to higher addresses for ZONE_NORMAL, and the
ITS driver stores the physical address in a 32-bit 'unsigned long'
variable.

Change the itt_addr variable to the correct phys_addr_t type instead,
along with all other variables in this driver that hold a physical
address.

The gicv5 driver correctly uses u64 variables, while all other irqchip
drivers don't call virt_to_phys or similar interfaces. It's expected that
other device drivers have similar issues, but fixing this one is
sufficient for booting a virtio based guest.

## Affected

- `Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < e332b3b69e5b3acf07204a4b185071bab15c2b88`
- `Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < e2f9c751f73a2d5bb62d94ab030aec118a811f27`
- `Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < 85215d633983233809f7d4dad163b953331b8238`
- `Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < 1b323391560354d8c515de8658b057a1daa82adb`
- `Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < 084ba3b99f2dfd991ce7e84fb17117319ec3cd9f`
- `Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < 03faa61eb4b9ca9aa09bd91d4c3773d8e7b1ac98`
- `Linux >= cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e < 8d76a7d89c12d08382b66e2f21f20d0627d14859`
- `Linux 3.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.