CVE-2026-23346 arm64: io: Extract user memory type in ioremap_prot()
A flaw in the Linux kernel arm64 ioremap_prot function causes kernel faults when accessing user memory mappings, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23346?
CVE-2026-23346 is a medium-severity denial of service vulnerability in Linux kernel, published on 25 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
arm64: io: Extract user memory type in ioremap_prot()
The only caller of ioremap_prot() outside of the generic ioremap() implementation is generic_access_phys(), which passes a 'pgprot_t' value determined from the user mapping of the target 'pfn' being accessed by the kernel. On arm64, the 'pgprot_t' contains all of the non-address bits from the pte, including the permission controls, and so we end up returning a new user mapping from ioremap_prot() which faults when accessed from the kernel on systems with PAN:
| Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000 | ... | Call trace: | __memcpy_fromio+0x80/0xf8 | generic_access_phys+0x20c/0x2b8 | __access_remote_vm+0x46c/0x5b8 | access_remote_vm+0x18/0x30 | environ_read+0x238/0x3e8 | vfs_read+0xe4/0x2b0 | ksys_read+0xcc/0x178 | __arm64_sys_read+0x4c/0x68
Extract only the memory type from the user 'pgprot_t' in ioremap_prot() and assert that we're being passed a user mapping, to protect us against any changes in future that may require additional handling. To avoid falsely flagging users of ioremap(), provide our own ioremap() macro which simply wraps __ioremap_prot().
Which versions are affected by CVE-2026-23346?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23346?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-23346 being exploited?
There is no known exploitation of CVE-2026-23346 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-80627, BELL-CVE-2026-23346, DEBIAN-CVE-2026-23346, GHSA-xqp7-9gqv-6978, ROOT-OS-DEBIAN-12-CVE-2026-23346, ROOT-OS-DEBIAN-13-CVE-2026-23346 and 2 more.