---
id: CVE-2026-23067
title: 'iommu/io-pgtable-arm: fix size_t signedness bug in unmap path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommu/io-pgtable-arm: fix size_t signedness bug in unmap path

  __arm_lpae_unmap() returns size_t but was returning -ENOENT (negative
  error code) when encountering an un…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3318f7b5cefbff96b1bb49584ac38d2c9997a830 <
    41ec6988547819756fb65e94fc24f3e0dddf84ac
  - >-
    Linux >= 3318f7b5cefbff96b1bb49584ac38d2c9997a830 <
    374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8
  - Linux 6.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:19:04.606718Z'
published: '2026-02-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:16.182Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23067'
references:
  - url: 'https://git.kernel.org/stable/c/41ec6988547819756fb65e94fc24f3e0dddf84ac'
  - url: 'https://git.kernel.org/stable/c/374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8'
tags:
  - cve.org
epss: 0.00129
epssPercentile: 0.02535
ingestedAt: '2026-11-05T22:38:32.068Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iommu/io-pgtable-arm: fix size_t signedness bug in unmap path

__arm_lpae_unmap() returns size_t but was returning -ENOENT (negative
error code) when encountering an unmapped PTE. Since size_t is unsigned,
-ENOENT (typically -2) becomes a huge positive value (0xFFFFFFFFFFFFFFFE
on 64-bit systems).

This corrupted value propagates through the call chain:
  __arm_lpae_unmap() returns -ENOENT as size_t
  -> arm_lpae_unmap_pages() returns it
  -> __iommu_unmap() adds it to iova address
  -> iommu_pgsize() triggers BUG_ON due to corrupted iova

This can cause IOVA address overflow in __iommu_unmap() loop and
trigger BUG_ON in iommu_pgsize() from invalid address alignment.

Fix by returning 0 instead of -ENOENT. The WARN_ON already signals
the error condition, and returning 0 (meaning "nothing unmapped")
is the correct semantic for size_t return type. This matches the
behavior of other io-pgtable implementations (io-pgtable-arm-v7s,
io-pgtable-dart) which return 0 on error conditions.

## Affected

- `Linux >= 3318f7b5cefbff96b1bb49584ac38d2c9997a830 < 41ec6988547819756fb65e94fc24f3e0dddf84ac`
- `Linux >= 3318f7b5cefbff96b1bb49584ac38d2c9997a830 < 374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8`
- `Linux 6.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.