CVE-2026-23067
Description
An integer signedness bug was found in the Linux kernel's ARM IOMMU page table implementation. The __arm_lpae_unmap() function returns size_t (unsigned) but was returning -ENOENT (negative error code) on error. The negative value becomes a huge positive number (0xFFFFFFFFFFFFFFFE on 64-bit) which propagates through the call chain, causing IOVA address overflow in __iommu_unmap() and triggering a BUG_ON in iommu_pgsize() due to invalid address alignment.
Statement
This bug affects ARM-based systems using the LPAE (Large Physical Address Extension) IOMMU page table format. The crash occurs when attempting to unmap an already-unmapped PTE, which can happen during device driver cleanup or error recovery paths. The impact is limited to denial of service through a kernel panic.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
