CVE-2026-23067: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23067 is a signedness bug in the Linux kernel's IOMMU iommu/io-pgtable-arm subsystem within the __arm_lpae_unmap() function. The function returns size_t (an unsigned type) but incorrectly returned -ENOENT (a negative error code) when encountering an unmapped page table entry (PTE), causing the negative value to be interpreted as a massive positive integer (0xFFFFFFFFFFFFFFFE on 64-bit systems). Affected versions are Linux kernel 6.16 through 6.18.7 and release candidates 6.19-rc1 through 6.19-rc6. It was published on February 4, 2026, with patches released on March 13, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a type signedness mismatch (CWE-617: Reachable Assertion) in __arm_lpae_unmap(), which declares a size_t return type but returned the negative error code -ENOENT on unmapped PTE conditions. Because size_t is unsigned, this value wraps to 0xFFFFFFFFFFFFFFFE on 64-bit systems. The corrupted value propagates through the call chain: __arm_lpae_unmap() → arm_lpae_unmap_pages() → __iommu_unmap(), where it is added to the IOVA address causing an overflow, which then triggers a BUG_ON assertion in iommu_pgsize() due to invalid address alignment. The fix replaces the -ENOENT return with 0 (meaning "nothing unmapped"), consistent with other io-pgtable implementations such as io-pgtable-arm-v7s and io-pgtable-dart (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation causes a kernel panic (BUG_ON assertion failure) in iommu_pgsize(), resulting in a denial of service (system crash) on affected hosts. The impact is limited to availability — there is no confidentiality or integrity impact — but a kernel panic on a production system can cause significant service disruption. Systems using IOMMU functionality (common in virtualization, device passthrough, and embedded ARM platforms) with low-privilege local user access are at risk (Feedly).

The vulnerability is resolved in Linux kernel version 6.18.8 and later, as well as 6.19-rc7 and later. Administrators should upgrade affected kernels (versions 6.16 through 6.18.7, and 6.19-rc1 through 6.19-rc6) to 6.18.8 or apply the upstream patch commits directly. Patch commits are available at 374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8 and 41ec6988547819756fb65e94fc24f3e0dddf84ac on the stable kernel tree. As a temporary measure, restricting local user access to IOMMU-related operations can reduce exposure until patching is feasible (Feedly, Kernel Patch 1, Kernel Patch 2).