CVE-2026-23345: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23345 is a memory management flaw in the Linux kernel's ARM64 Guarded Control Stack (GCS) implementation that causes kernel panics and denial of service when FEAT_LPA2 (52-bit address support) is enabled. The vulnerability was published on March 25, 2026, and affects Linux kernel versions 6.13 through 6.18.16, 6.19 through 6.19.6, and 7.0-rc1 through 7.0-rc7. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-386 (Symbolic Name not Mapping to Correct Object): the _PAGE_GCS and _PAGE_GCS_RO PTE macro definitions incorrectly include PTE_SHARED bits set to 0b11. When FEAT_LPA2 is active, bits 8–9 of the PTE are repurposed to encode bits 50–51 of the physical output address rather than shareability attributes, so the incorrectly set bits corrupt the address translation and produce invalid memory mappings. This triggers a level 0 translation fault during GCS cleanup operations (specifically in gcs_free → vm_munmap → zap_huge_pmd), resulting in a kernel oops. The fix introduces a gcs_page_prot variable that conditionally clears PTE_SHARED when LPA2 is detected, mirroring the approach used for protection_map[], and removes the now-unused PAGE_GCS{,_RO} macros (Red Hat Bugzilla).

Successful exploitation causes a kernel panic (oops) on ARM64 systems with FEAT_LPA2 hardware support, resulting in a local denial of service. The crash occurs when a process using GCS exits and the kernel attempts to unmap GCS memory regions, making the system unavailable. There is no confidentiality or integrity impact; the vulnerability is limited to availability on affected ARM64 hardware (Red Hat Advisory, Red Hat Bugzilla).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg containing Unable to handle kernel paging request at virtual address with FSC = 0x04: level 0 translation fault and call trace including zap_huge_pmd, gcs_free, do_exit.
• Logs: Kernel taint flags [M]=MACHINE_CHECK appearing in oops output on affected ARM64 systems.
• Process: Processes named gcs_write_fault or similar GCS test/workload processes crashing repeatedly at exit.
• System: Unexpected system reboots or kernel panics on ARM64 hosts with 52-bit VA (FEAT_LPA2) hardware when GCS is in use.

Apply kernel updates that include the fix: version 6.18.17 or later for 6.18.x systems, and 6.19.7 or later for 6.19.x systems; users on 7.0-rc builds should update to the latest stable release. Patch commits are available in the Linux kernel stable repository (kernel patches). Red Hat has tracked the issue under Bugzilla #2451233 and Amazon Linux 2023 has issued advisory ALAS2023-2026-1596. As a temporary workaround where patching is not immediately possible, disabling GCS functionality on affected ARM64 systems can prevent the crash from occurring (Red Hat Bugzilla).

Red Hat triaged the issue at medium severity and tracked it via their Product Security team through Bugzilla. The upstream kernel CVE announcement was published via the linux-cve-announce mailing list by Greg Kroah-Hartman. The Yocto Project security list and Amazon Linux security teams also acknowledged the issue and issued advisories. No notable broader media coverage or significant social media discussion has been observed, consistent with the vulnerability's limited scope to specific ARM64 hardware configurations (Red Hat Bugzilla).