{"id":"CVE-2026-23067","title":"iommu/io-pgtable-arm: fix size_t signedness bug in unmap path","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/io-pgtable-arm: fix size_t signedness bug in unmap path\n\n__arm_lpae_unmap() returns size_t but was returning -ENOENT (negative\nerror code) when encountering an un…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 3318f7b5cefbff96b1bb49584ac38d2c9997a830 < 41ec6988547819756fb65e94fc24f3e0dddf84ac","Linux >= 3318f7b5cefbff96b1bb49584ac38d2c9997a830 < 374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8","Linux 6.16"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:19:04.606718Z"},"published":"2026-02-04","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:23:16.182Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23067","references":[{"url":"https://git.kernel.org/stable/c/41ec6988547819756fb65e94fc24f3e0dddf84ac"},{"url":"https://git.kernel.org/stable/c/374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8"}],"tags":["cve.org"],"epss":0.00129,"epssPercentile":0.02535,"ingestedAt":"2026-11-05T22:38:32.068Z","slug":"CVE-2026-23067","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/io-pgtable-arm: fix size_t signedness bug in unmap path\n\n__arm_lpae_unmap() returns size_t but was returning -ENOENT (negative\nerror code) when encountering an unmapped PTE. Since size_t is unsigned,\n-ENOENT (typically -2) becomes a huge positive value (0xFFFFFFFFFFFFFFFE\non 64-bit systems).\n\nThis corrupted value propagates through the call chain:\n  __arm_lpae_unmap() returns -ENOENT as size_t\n  -> arm_lpae_unmap_pages() returns it\n  -> __iommu_unmap() adds it to iova address\n  -> iommu_pgsize() triggers BUG_ON due to corrupted iova\n\nThis can cause IOVA address overflow in __iommu_unmap() loop and\ntrigger BUG_ON in iommu_pgsize() from invalid address alignment.\n\nFix by returning 0 instead of -ENOENT. The WARN_ON already signals\nthe error condition, and returning 0 (meaning \"nothing unmapped\")\nis the correct semantic for size_t return type. This matches the\nbehavior of other io-pgtable implementations (io-pgtable-arm-v7s,\nio-pgtable-dart) which return 0 on error conditions.\n\n## Affected\n\n- `Linux >= 3318f7b5cefbff96b1bb49584ac38d2c9997a830 < 41ec6988547819756fb65e94fc24f3e0dddf84ac`\n- `Linux >= 3318f7b5cefbff96b1bb49584ac38d2c9997a830 < 374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8`\n- `Linux 6.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}