CVE-2026-23085 irqchip/gic-v3-its: Avoid truncating memory addresses
An integer truncation in the Linux kernel GICv3 ITS driver can cause a system crash on 32-bit ARM systems with LPAE enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23085?
CVE-2026-23085 is a medium-severity vulnerability in Linux kernel, published on 4 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
irqchip/gic-v3-its: Avoid truncating memory addresses
On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while experimenting with larger VMSPLIT configurations.
This caused the qemu virt model to crash in the GICv3 driver, which allocates the 'itt' object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses for ZONE_NORMAL, and the ITS driver stores the physical address in a 32-bit 'unsigned long' variable.
Change the itt_addr variable to the correct phys_addr_t type instead, along with all other variables in this driver that hold a physical address.
The gicv5 driver correctly uses u64 variables, while all other irqchip drivers don't call virt_to_phys or similar interfaces. It's expected that other device drivers have similar issues, but fixing this one is sufficient for booting a virtio based guest.
Weakness: CWE-190
Which versions are affected by CVE-2026-23085?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23085?
Apply the vendor's patch.
Is CVE-2026-23085 being exploited?
There is no known exploitation of CVE-2026-23085 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-77217, BELL-CVE-2026-23085, DEBIAN-CVE-2026-23085, GHSA-v2xc-c9fw-v73w, OESA-2026-1469, OESA-2026-1470 and 3 more.