{"id":"CVE-2026-23346","title":"arm64: io: Extract user memory type in ioremap_prot()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: io: Extract user memory type in ioremap_prot()\n\nThe only caller of ioremap_prot() outside of the generic ioremap()\nimplementation is generic_access_phys(), which…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 893dea9ccd08dab924839354aba21d4ed7a9abc0 < 64858b76ec67c5fc40fef8ec1841fecb78c1ebde","Linux >= 893dea9ccd08dab924839354aba21d4ed7a9abc0 < eeecafce5afffb4da703666ebefbd4d6e2a5abf6","Linux >= 893dea9ccd08dab924839354aba21d4ed7a9abc0 < 3d64dcc0799c2d6921ba027716b7be721eb19fa8","Linux >= 893dea9ccd08dab924839354aba21d4ed7a9abc0 < d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a","Linux >= 893dea9ccd08dab924839354aba21d4ed7a9abc0 < 8f098037139b294050053123ab2bc0f819d08932","Linux 6.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:27:28.824193Z"},"published":"2026-03-25","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:33:41.098Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23346","references":[{"url":"https://git.kernel.org/stable/c/64858b76ec67c5fc40fef8ec1841fecb78c1ebde"},{"url":"https://git.kernel.org/stable/c/eeecafce5afffb4da703666ebefbd4d6e2a5abf6"},{"url":"https://git.kernel.org/stable/c/3d64dcc0799c2d6921ba027716b7be721eb19fa8"},{"url":"https://git.kernel.org/stable/c/d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a"},{"url":"https://git.kernel.org/stable/c/8f098037139b294050053123ab2bc0f819d08932"}],"tags":["cve.org"],"epss":0.00132,"epssPercentile":0.02819,"ingestedAt":"2026-11-05T22:38:32.118Z","slug":"CVE-2026-23346","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narm64: io: Extract user memory type in ioremap_prot()\n\nThe only caller of ioremap_prot() outside of the generic ioremap()\nimplementation is generic_access_phys(), which passes a 'pgprot_t' value\ndetermined from the user mapping of the target 'pfn' being accessed by\nthe kernel. On arm64, the 'pgprot_t' contains all of the non-address\nbits from the pte, including the permission controls, and so we end up\nreturning a new user mapping from ioremap_prot() which faults when\naccessed from the kernel on systems with PAN:\n\n  | Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000\n  | ...\n  | Call trace:\n  |   __memcpy_fromio+0x80/0xf8\n  |   generic_access_phys+0x20c/0x2b8\n  |   __access_remote_vm+0x46c/0x5b8\n  |   access_remote_vm+0x18/0x30\n  |   environ_read+0x238/0x3e8\n  |   vfs_read+0xe4/0x2b0\n  |   ksys_read+0xcc/0x178\n  |   __arm64_sys_read+0x4c/0x68\n\nExtract only the memory type from the user 'pgprot_t' in ioremap_prot()\nand assert that we're being passed a user mapping, to protect us against\nany changes in future that may require additional handling. To avoid\nfalsely flagging users of ioremap(), provide our own ioremap() macro\nwhich simply wraps __ioremap_prot().\n\n## Affected\n\n- `Linux >= 893dea9ccd08dab924839354aba21d4ed7a9abc0 < 64858b76ec67c5fc40fef8ec1841fecb78c1ebde`\n- `Linux >= 893dea9ccd08dab924839354aba21d4ed7a9abc0 < eeecafce5afffb4da703666ebefbd4d6e2a5abf6`\n- `Linux >= 893dea9ccd08dab924839354aba21d4ed7a9abc0 < 3d64dcc0799c2d6921ba027716b7be721eb19fa8`\n- `Linux >= 893dea9ccd08dab924839354aba21d4ed7a9abc0 < d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a`\n- `Linux >= 893dea9ccd08dab924839354aba21d4ed7a9abc0 < 8f098037139b294050053123ab2bc0f819d08932`\n- `Linux 6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}