CVE-2026-23067: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23067 is a signedness bug in the Linux kernel's IOMMU iommu/io-pgtable-arm subsystem within the __arm_lpae_unmap() function. The function returns size_t (an unsigned type) but incorrectly returned -ENOENT (a negative error code) when encountering an unmapped page table entry (PTE), causing the negative value to be interpreted as a massive positive integer (0xFFFFFFFFFFFFFFFE on 64-bit systems). Affected versions are Linux kernel 6.16 through 6.18.7 and release candidates 6.19-rc1 through 6.19-rc6. It was published on February 4, 2026, with patches released on March 13, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a type signedness mismatch (CWE-617: Reachable Assertion) in __arm_lpae_unmap(), which declares a size_t return type but returned the negative error code -ENOENT on unmapped PTE conditions. Because size_t is unsigned, this value wraps to 0xFFFFFFFFFFFFFFFE on 64-bit systems. The corrupted value propagates through the call chain: __arm_lpae_unmap() → arm_lpae_unmap_pages() → __iommu_unmap(), where it is added to the IOVA address causing an overflow, which then triggers a BUG_ON assertion in iommu_pgsize() due to invalid address alignment. The fix replaces the -ENOENT return with 0 (meaning "nothing unmapped"), consistent with other io-pgtable implementations such as io-pgtable-arm-v7s and io-pgtable-dart (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation causes a kernel panic (BUG_ON assertion failure) in iommu_pgsize(), resulting in a denial of service (system crash) on affected hosts. The impact is limited to availability — there is no confidentiality or integrity impact — but a kernel panic on a production system can cause significant service disruption. Systems using IOMMU functionality (common in virtualization, device passthrough, and embedded ARM platforms) with low-privilege local user access are at risk (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability requires local access with low privileges to trigger IOMMU unmap operations on an affected kernel. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The vulnerability is resolved in Linux kernel version 6.18.8 and later, as well as 6.19-rc7 and later. Administrators should upgrade affected kernels (versions 6.16 through 6.18.7, and 6.19-rc1 through 6.19-rc6) to 6.18.8 or apply the upstream patch commits directly. Patch commits are available at 374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8 and 41ec6988547819756fb65e94fc24f3e0dddf84ac on the stable kernel tree. As a temporary measure, restricting local user access to IOMMU-related operations can reduce exposure until patching is feasible (Feedly, Kernel Patch 1, Kernel Patch 2).