{"id":"CVE-2026-23085","revision":"81dce1449fb348e3ae52f3a16da4f1ef","records":[{"revision":"81dce1449fb348e3ae52f3a16da4f1ef","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-23085","aliases":[],"title":"irqchip/gic-v3-its: Avoid truncating memory addresses","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v3-its: Avoid truncating memory addresses\n\nOn 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem\nallocations to be backed by addresses physical memory above the 32-bit\naddress limit, as found while experimenting with larger VMSPLIT\nconfigurations.\n\nThis caused the qemu virt model to crash in the GICv3 driver, which\nallocates the 'itt' object using GFP_KERNEL. Since all memory below\nthe 4GB physical address limit is in ZONE_DMA in this configuration,\nkmalloc() defaults to higher addresses for ZONE_NORMAL, and the\nITS driver stores the physical address in a 32-bit 'unsigned long'\nvariable.\n\nChange the itt_addr variable to the correct phys_addr_t type instead,\nalong with all other variables in this driver that hold a physical\naddress.\n\nThe gicv5 driver correctly uses u64 variables, while all other irqchip\ndrivers don't call virt_to_phys or similar interfaces. It's expected that\nother device drivers have similar issues, but fixing this one is\nsufficient for booting a virtio based guest.","state":0,"publishedAt":"2026-02-04T16:08:09.368+00:00","modifiedAt":"2026-10-19T18:25:29.916+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/irqchip/irq-gic-v3-its.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e\",\n                            \"lessThan\": \"e332b3b69e5b3acf07204a4b185071bab15c2b88\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e\",\n                            \"lessThan\": \"e2f9c751f73a2d5bb62d94ab030aec118a811f27\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e\",\n                            \"lessThan\": \"85215d633983233809f7d4dad163b953331b8238\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e\",\n                            \"lessThan\": \"1b323391560354d8c515de8658b057a1daa82adb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e\",\n                            \"lessThan\": \"084ba3b99f2dfd991ce7e84fb17117319ec3cd9f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e\",\n                            \"lessThan\": \"03faa61eb4b9ca9aa09bd91d4c3773d8e7b1ac98\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cc2d3216f53c9fff0030eb71cacc4ce5f39d1d7e\",\n                            \"lessThan\": \"8d76a7d89c12d08382b66e2f21f20d0627d14859\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/irqchip/irq-gic-v3-its.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.19\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.19\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.249\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.199\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.162\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.122\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.68\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.8\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/e332b3b69e5b3acf07204a4b185071bab15c2b88","https://git.kernel.org/stable/c/e2f9c751f73a2d5bb62d94ab030aec118a811f27","https://git.kernel.org/stable/c/85215d633983233809f7d4dad163b953331b8238","https://git.kernel.org/stable/c/1b323391560354d8c515de8658b057a1daa82adb","https://git.kernel.org/stable/c/084ba3b99f2dfd991ce7e84fb17117319ec3cd9f","https://git.kernel.org/stable/c/03faa61eb4b9ca9aa09bd91d4c3773d8e7b1ac98","https://git.kernel.org/stable/c/8d76a7d89c12d08382b66e2f21f20d0627d14859"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23085","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-23085","identifiers":["CVE-2026-23085"]},"retained":false,"historicalAffected":[]}],"coverage":[]}