CVE-2026-23085: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23085 is a memory address truncation vulnerability in the Linux kernel's irqchip/gic-v3-its (GICv3 ITS interrupt controller) driver. On 32-bit machines with CONFIG_ARM_LPAE enabled, physical memory addresses above the 32-bit (4 GB) limit can be incorrectly truncated when stored in a 32-bit unsigned long variable, causing system crashes. The vulnerability was published on February 4, 2026, and affects Linux kernel versions from 3.19 through multiple stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, CVE.org).

The root cause is an incorrect data type used for physical address storage in the GICv3 ITS driver (CWE-704: Incorrect Type Conversion or Cast). When kmalloc() allocates the itt object using GFP_KERNEL on a 32-bit ARM system with CONFIG_ARM_LPAE, the allocator may return a physical address above 4 GB (from ZONE_NORMAL), since all memory below 4 GB is reserved for ZONE_DMA in this configuration. The driver then stores this address in a 32-bit unsigned long variable (itt_addr), silently truncating the upper bits and causing the GICv3 driver to reference an incorrect physical address, ultimately crashing the QEMU virt model. The fix changes itt_addr and all other physical address variables in the driver to the correct phys_addr_t type (Feedly, kernel patch).

Successful triggering of this vulnerability results in a kernel crash (system unavailability), making it a denial-of-service condition. The impact is limited to availability — there is no confidentiality or integrity impact. Affected systems are 32-bit ARM machines with CONFIG_ARM_LPAE and larger VMSPLIT configurations, including virtualized environments using the QEMU virt model with GICv3 interrupt controllers (Feedly).

This vulnerability requires local access with low privileges to trigger (CVSS attack vector: Local, privileges required: Low). There is no known public proof-of-concept exploit code, no evidence of in-the-wild exploitation, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8, and 6.19-rc7. Patches are available in the upstream stable kernel repository. Administrators running 32-bit ARM systems with CONFIG_ARM_LPAE should update to a patched kernel version as soon as possible. Downstream distributions including Ubuntu (USN-8162-1, USN-8180-x series, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1), SUSE, Oracle Linux, and Amazon Linux 2 have also issued updated kernel packages (Ubuntu USN-8162-1, Ubuntu USN-8180-1, Amazon Linux, kernel patch).