CVE-2026-23346
published 2026-03-25CVE-2026-23346: In the Linux kernel, the following vulnerability has been resolved: arm64: io: Extract user memory type in ioremap_prot() The only caller of ioremap_prot()…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.13%
2.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
arm64: io: Extract user memory type in ioremap_prot()
The only caller of ioremap_prot() outside of the generic ioremap()
implementation is generic_access_phys(), which passes a 'pgprot_t' value
determined from the user mapping of the target 'pfn' being accessed by
the kernel. On arm64, the 'pgprot_t' contains all of the non-address
bits from the pte, including the permission controls, and so we end up
returning a new user mapping from ioremap_prot() which faults when
accessed from the kernel on systems with PAN:
| Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000
| ...
| Call trace:
| __memcpy_fromio+0x80/0xf8
| generic_access_phys+0x20c/0x2b8
| __access_remote_vm+0x46c/0x5b8
| access_remote_vm+0x18/0x30
| environ_read+0x238/0x3e8
| vfs_read+0xe4/0x2b0
| ksys_read+0xcc/0x178
| __arm64_sys_read+0x4c/0x68
Extract only the memory type from the user 'pgprot_t' in ioremap_prot()
and assert that we're being passed a user mapping, to protect us against
any changes in future that may require additional handling. To avoid
falsely flagging users of ioremap(), provide our own ioremap() macro
which simply wraps __ioremap_prot().
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.8-1 (forky) | linux 6.19.8-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 893dea9ccd08dab924839354aba21d4ed7a9abc0 < 64858b76ec67c5fc40fef8ec1841fecb78c1ebde | 64858b76ec67c5fc40fef8ec1841fecb78c1ebde |
| linux | linux | >= 893dea9ccd08dab924839354aba21d4ed7a9abc0 < eeecafce5afffb4da703666ebefbd4d6e2a5abf6 | eeecafce5afffb4da703666ebefbd4d6e2a5abf6 |
| linux | linux | >= 893dea9ccd08dab924839354aba21d4ed7a9abc0 < 3d64dcc0799c2d6921ba027716b7be721eb19fa8 | 3d64dcc0799c2d6921ba027716b7be721eb19fa8 |
| linux | linux | >= 893dea9ccd08dab924839354aba21d4ed7a9abc0 < d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a | d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a |
| linux | linux | >= 893dea9ccd08dab924839354aba21d4ed7a9abc0 < 8f098037139b294050053123ab2bc0f819d08932 | 8f098037139b294050053123ab2bc0f819d08932 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.8-1 | 6.19.8-1 |
| linux | linux_kernel | >= 6.0.0 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.0.1 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.19 < 6.19.7 | 6.19.7 |
| linux | linux_kernel | >= 6.19.0 < 6.19.7 | 6.19.7 |
| msrc | azl3_kernel_6.6.126.1-1_on_azure_linux_3.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: arm64: io: Extract user memory type in ioremap_prot()
vendor_redhat·2026-03-25·CVSS 5.5
CVE-2026-23346 [MEDIUM] CWE-843 kernel: arm64: io: Extract user memory type in ioremap_prot()
kernel: arm64: io: Extract user memory type in ioremap_prot()
In the Linux kernel, the following vulnerability has been resolved:
arm64: io: Extract user memory type in ioremap_prot()
The only caller of ioremap_prot() outside of the generic ioremap()
implementation is generic_access_phys(), which passes a 'pgprot_t' value
determined from the user mapping of the target 'pfn' being accessed by
the kernel. On arm64, the 'pgprot_t' contains all of the non-address
bits from the pte, including the permission controls, and so we end up
returning a new user mapping from ioremap_prot() which faults when
accessed from the kernel on systems with PAN:
| Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000
| ...
| Call trace:
| __memcpy_fromio+0x80/0xf8
| generic_acc
Microsoft
arm64: io: Extract user memory type in ioremap_prot()
vendor_msrc·2026-03-10·CVSS 5.5
CVE-2026-23346 [MEDIUM] arm64: io: Extract user memory type in ioremap_prot()
arm64: io: Extract user memory type in ioremap_prot()
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Debian
CVE-2026-23346: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: io: ...
vendor_debian·2026
CVE-2026-23346 CVE-2026-23346: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: io: ...
In the Linux kernel, the following vulnerability has been resolved: arm64: io: Extract user memory type in ioremap_prot() The only caller of ioremap_prot() outside of the generic ioremap() implementation is generic_access_phys(), which passes a 'pgprot_t' value determined from the user mapping of the target 'pfn' being accessed by the kernel. On arm64, the 'pgprot_t' contains all of the non-address bits from the pte, including the permission controls, and so we end up returning a new user mapping from ioremap_prot() which faults when accessed from the kernel on systems with PAN: | Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000 | ... | Call trace: | __memcpy_fromio+0x80/0xf8 | generic_access_phys+0x20c/0x2b8 | __access_remote_vm+0x46c/0x5b8 | access_
GHSA
GHSA-xqp7-9gqv-6978: In the Linux kernel, the following vulnerability has been resolved:
arm64: io: Extract user memory type in ioremap_prot()
The only caller of ioremap
ghsa_unreviewed·2026-03-25
CVE-2026-23346 GHSA-xqp7-9gqv-6978: In the Linux kernel, the following vulnerability has been resolved:
arm64: io: Extract user memory type in ioremap_prot()
The only caller of ioremap
In the Linux kernel, the following vulnerability has been resolved:
arm64: io: Extract user memory type in ioremap_prot()
The only caller of ioremap_prot() outside of the generic ioremap()
implementation is generic_access_phys(), which passes a 'pgprot_t' value
determined from the user mapping of the target 'pfn' being accessed by
the kernel. On arm64, the 'pgprot_t' contains all of the non-address
bits from the pte, including the permission controls, and so we end up
returning a new user mapping from ioremap_prot() which faults when
accessed from the kernel on systems with PAN:
| Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000
| ...
| Call trace:
| __memcpy_fromio+0x80/0xf8
| generic_access_phys+0x20c/0x2b8
| __access_remote_vm+0x46c/0x5b8
| acce
OSV
arm64: io: Extract user memory type in ioremap_prot()
osv·2026-03-25
CVE-2026-23346 arm64: io: Extract user memory type in ioremap_prot()
arm64: io: Extract user memory type in ioremap_prot()
In the Linux kernel, the following vulnerability has been resolved:
arm64: io: Extract user memory type in ioremap_prot()
The only caller of ioremap_prot() outside of the generic ioremap()
implementation is generic_access_phys(), which passes a 'pgprot_t' value
determined from the user mapping of the target 'pfn' being accessed by
the kernel. On arm64, the 'pgprot_t' contains all of the non-address
bits from the pte, including the permission controls, and so we end up
returning a new user mapping from ioremap_prot() which faults when
accessed from the kernel on systems with PAN:
| Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000
| ...
| Call trace:
| __memcpy_fromio+0x80/0xf8
| generic_access_p
OSV
CVE-2026-23346: In the Linux kernel, the following vulnerability has been resolved: arm64: io: Extract user memory type in ioremap_prot() The only caller of ioremap_p
osv·2026-03-25
CVE-2026-23346 CVE-2026-23346: In the Linux kernel, the following vulnerability has been resolved: arm64: io: Extract user memory type in ioremap_prot() The only caller of ioremap_p
In the Linux kernel, the following vulnerability has been resolved: arm64: io: Extract user memory type in ioremap_prot() The only caller of ioremap_prot() outside of the generic ioremap() implementation is generic_access_phys(), which passes a 'pgprot_t' value determined from the user mapping of the target 'pfn' being accessed by the kernel. On arm64, the 'pgprot_t' contains all of the non-address bits from the pte, including the permission controls, and so we end up returning a new user mapping from ioremap_prot() which faults when accessed from the kernel on systems with PAN: | Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000 | ... | Call trace: | __memcpy_fromio+0x80/0xf8 | generic_access_phys+0x20c/0x2b8 | __access_remote_vm+0x46c/0x5b8 | access_
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-23346 kernel: arm64: io: Extract user memory type in ioremap_prot()
bugzilla·2026-03-25·CVSS 5.5
CVE-2026-23346 [MEDIUM] CVE-2026-23346 kernel: arm64: io: Extract user memory type in ioremap_prot()
CVE-2026-23346 kernel: arm64: io: Extract user memory type in ioremap_prot()
In the Linux kernel, the following vulnerability has been resolved:
arm64: io: Extract user memory type in ioremap_prot()
The only caller of ioremap_prot() outside of the generic ioremap()
implementation is generic_access_phys(), which passes a 'pgprot_t' value
determined from the user mapping of the target 'pfn' being accessed by
the kernel. On arm64, the 'pgprot_t' contains all of the non-address
bits from the pte, including the permission controls, and so we end up
returning a new user mapping from ioremap_prot() which faults when
accessed from the kernel on systems with PAN:
| Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000
| ...
| Call trace:
| __memcpy_fromio+0x80/
Wiz
CVE-2026-23346 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2026-23346 CVE-2026-23346 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23346 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
arm64: io: Extract user memory type in ioremap_prot()
The only caller of ioremap_prot() outside of the generic ioremap()
implementation is generic_access_phys(), which passes a 'pgprot_t' value
determined from the user mapping of the target 'pfn' being accessed by
the kernel. On arm64, the 'pgprot_t' contains all of the non-address
bits from the pte, including the permission controls, and so we end up
returning a new user mapping from ioremap_prot() which faults when
accessed from the kernel on systems with PAN:
| Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000
| ...
| Call trace:
| __memcpy_fromio+0x80/0xf8
https://git.kernel.org/stable/c/3d64dcc0799c2d6921ba027716b7be721eb19fa8https://git.kernel.org/stable/c/64858b76ec67c5fc40fef8ec1841fecb78c1ebdehttps://git.kernel.org/stable/c/8f098037139b294050053123ab2bc0f819d08932https://git.kernel.org/stable/c/d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2ahttps://git.kernel.org/stable/c/eeecafce5afffb4da703666ebefbd4d6e2a5abf6
2026-03-25
Published