{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23345", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.999Z", "datePublished": "2026-03-25T10:27:32.432Z", "dateUpdated": "2026-03-25T10:27:32.432Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-03-25T10:27:32.432Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled\n\nWhen FEAT_LPA2 is enabled, bits 8-9 of the PTE replace the\nshareability attribute with bits 50-51 of the output address. The\n_PAGE_GCS{,_RO} definitions include the PTE_SHARED bits as 0b11 (this\nmatches the other _PAGE_* definitions) but using this macro directly\nleads to the following panic when enabling GCS on a system/model with\nLPA2:\n\n Unable to handle kernel paging request at virtual address fffff1ffc32d8008\n Mem abort info:\n ESR = 0x0000000096000004\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x04: level 0 translation fault\n Data abort info:\n ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n swapper pgtable: 4k pages, 52-bit VAs, pgdp=0000000060f4d000\n [fffff1ffc32d8008] pgd=100000006184b003, p4d=0000000000000000\n Internal error: Oops: 0000000096000004 [#1] SMP\n CPU: 0 UID: 0 PID: 513 Comm: gcs_write_fault Tainted: G M 7.0.0-rc1 #1 PREEMPT\n Tainted: [M]=MACHINE_CHECK\n Hardware name: QEMU QEMU Virtual Machine, BIOS 2025.02-8+deb13u1 11/08/2025\n pstate: 03402005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : zap_huge_pmd+0x168/0x468\n lr : zap_huge_pmd+0x2c/0x468\n sp : ffff800080beb660\n x29: ffff800080beb660 x28: fff00000c2058180 x27: ffff800080beb898\n x26: fff00000c2058180 x25: ffff800080beb820 x24: 00c800010b600f41\n x23: ffffc1ffc30af1a8 x22: fff00000c2058180 x21: 0000ffff8dc00000\n x20: fff00000c2bc6370 x19: ffff800080beb898 x18: ffff800080bebb60\n x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000007\n x14: 000000000000000a x13: 0000aaaacbbbffff x12: 0000000000000000\n x11: 0000ffff8ddfffff x10: 00000000000001fe x9 : 0000ffff8ddfffff\n x8 : 0000ffff8de00000 x7 : 0000ffff8da00000 x6 : fff00000c2bc6370\n x5 : 0000ffff8da00000 x4 : 000000010b600000 x3 : ffffc1ffc0000000\n x2 : fff00000c2058180 x1 : fffff1ffc32d8000 x0 : 000000c00010b600\n Call trace:\n zap_huge_pmd+0x168/0x468 (P)\n unmap_page_range+0xd70/0x1560\n unmap_single_vma+0x48/0x80\n unmap_vmas+0x90/0x180\n unmap_region+0x88/0xe4\n vms_complete_munmap_vmas+0xf8/0x1e0\n do_vmi_align_munmap+0x158/0x180\n do_vmi_munmap+0xac/0x160\n __vm_munmap+0xb0/0x138\n vm_munmap+0x14/0x20\n gcs_free+0x70/0x80\n mm_release+0x1c/0xc8\n exit_mm_release+0x28/0x38\n do_exit+0x190/0x8ec\n do_group_exit+0x34/0x90\n get_signal+0x794/0x858\n arch_do_signal_or_restart+0x11c/0x3e0\n exit_to_user_mode_loop+0x10c/0x17c\n el0_da+0x8c/0x9c\n el0t_64_sync_handler+0xd0/0xf0\n el0t_64_sync+0x198/0x19c\n Code: aa1603e2 d34cfc00 cb813001 8b011861 (f9400420)\n\nSimilarly to how the kernel handles protection_map[], use a\ngcs_page_prot variable to store the protection bits and clear PTE_SHARED\nif LPA2 is enabled.\n\nAlso remove the unused PAGE_GCS{,_RO} macros."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/include/asm/pgtable-prot.h", "arch/arm64/mm/mmap.c"], "versions": [{"version": "6497b66ba6945f142902c7e8fce86e47016ead1c", "lessThan": "ca1684dd297bf0725c1d487cff80e615497accf6", "status": "affected", "versionType": "git"}, {"version": "6497b66ba6945f142902c7e8fce86e47016ead1c", "lessThan": "1df3ef7e612d6ccbae5a48e1121553c47c2123d6", "status": "affected", "versionType": "git"}, {"version": "6497b66ba6945f142902c7e8fce86e47016ead1c", "lessThan": "8a85b3131225a8c8143ba2ae29c0eef8c1f9117f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/include/asm/pgtable-prot.h", "arch/arm64/mm/mmap.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.17", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0-rc2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.0-rc2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ca1684dd297bf0725c1d487cff80e615497accf6"}, {"url": "https://git.kernel.org/stable/c/1df3ef7e612d6ccbae5a48e1121553c47c2123d6"}, {"url": "https://git.kernel.org/stable/c/8a85b3131225a8c8143ba2ae29c0eef8c1f9117f"}], "title": "arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled\n\nWhen FEAT_LPA2 is enabled, bits 8-9 of the PTE replace the\nshareability attribute with bits 50-51 of the output address. The\n_PAGE_GCS{,_RO} definitions include the PTE_SHARED bits as 0b11 (this\nmatches the other _PAGE_* definitions) but using this macro directly\nleads to the following panic when enabling GCS on a system/model with\nLPA2:\n\n Unable to handle kernel paging request at virtual address fffff1ffc32d8008\n Mem abort info:\n ESR = 0x0000000096000004\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x04: level 0 translation fault\n Data abort info:\n ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n swapper pgtable: 4k pages, 52-bit VAs, pgdp=0000000060f4d000\n [fffff1ffc32d8008] pgd=100000006184b003, p4d=0000000000000000\n Internal error: Oops: 0000000096000004 [#1] SMP\n CPU: 0 UID: 0 PID: 513 Comm: gcs_write_fault Tainted: G M 7.0.0-rc1 #1 PREEMPT\n Tainted: [M]=MACHINE_CHECK\n Hardware name: QEMU QEMU Virtual Machine, BIOS 2025.02-8+deb13u1 11/08/2025\n pstate: 03402005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : zap_huge_pmd+0x168/0x468\n lr : zap_huge_pmd+0x2c/0x468\n sp : ffff800080beb660\n x29: ffff800080beb660 x28: fff00000c2058180 x27: ffff800080beb898\n x26: fff00000c2058180 x25: ffff800080beb820 x24: 00c800010b600f41\n x23: ffffc1ffc30af1a8 x22: fff00000c2058180 x21: 0000ffff8dc00000\n x20: fff00000c2bc6370 x19: ffff800080beb898 x18: ffff800080bebb60\n x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000007\n x14: 000000000000000a x13: 0000aaaacbbbffff x12: 0000000000000000\n x11: 0000ffff8ddfffff x10: 00000000000001fe x9 : 0000ffff8ddfffff\n x8 : 0000ffff8de00000 x7 : 0000ffff8da00000 x6 : fff00000c2bc6370\n x5 : 0000ffff8da00000 x4 : 000000010b600000 x3 : ffffc1ffc0000000\n x2 : fff00000c2058180 x1 : fffff1ffc32d8000 x0 : 000000c00010b600\n Call trace:\n zap_huge_pmd+0x168/0x468 (P)\n unmap_page_range+0xd70/0x1560\n unmap_single_vma+0x48/0x80\n unmap_vmas+0x90/0x180\n unmap_region+0x88/0xe4\n vms_complete_munmap_vmas+0xf8/0x1e0\n do_vmi_align_munmap+0x158/0x180\n do_vmi_munmap+0xac/0x160\n __vm_munmap+0xb0/0x138\n vm_munmap+0x14/0x20\n gcs_free+0x70/0x80\n mm_release+0x1c/0xc8\n exit_mm_release+0x28/0x38\n do_exit+0x190/0x8ec\n do_group_exit+0x34/0x90\n get_signal+0x794/0x858\n arch_do_signal_or_restart+0x11c/0x3e0\n exit_to_user_mode_loop+0x10c/0x17c\n el0_da+0x8c/0x9c\n el0t_64_sync_handler+0xd0/0xf0\n el0t_64_sync+0x198/0x19c\n Code: aa1603e2 d34cfc00 cb813001 8b011861 (f9400420)\n\nSimilarly to how the kernel handles protection_map[], use a\ngcs_page_prot variable to store the protection bits and clear PTE_SHARED\nif LPA2 is enabled.\n\nAlso remove the unused PAGE_GCS{,_RO} macros."}], "id": "CVE-2026-23345", "lastModified": "2026-03-25T15:41:33.977", "metrics": {}, "published": "2026-03-25T11:16:32.610", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1df3ef7e612d6ccbae5a48e1121553c47c2123d6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8a85b3131225a8c8143ba2ae29c0eef8c1f9117f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ca1684dd297bf0725c1d487cff80e615497accf6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled", "id": "2451233", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451233"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-386", "details": ["A flaw was found in the Linux kernel. When the FEAT_LPA2 feature is enabled on ARM64 systems, the kernel incorrectly handles the PTE_SHARED bits in Graphics Control System (GCS) memory mappings. This misconfiguration can lead to a kernel paging request and subsequently a system panic, resulting in a Denial of Service (DoS). A local user or specific system configuration could trigger this vulnerability."], "name": "CVE-2026-23345", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23345\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23345\nhttps://lore.kernel.org/linux-cve-announce/2026032535-CVE-2026-23345-c154@gregkh/T"], "statement": "This flaw is specific to ARM64 systems with both FEAT_LPA2 (Large Physical Address 2) and GCS (Guarded Control Stack) enabled. When LPA2 is active, PTE bits 8-9 have a different meaning than shareability, causing incorrect address translation for GCS mappings. This is an uncommon hardware configuration combination, primarily affecting newer ARM platforms.", "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-03-25T12:12:49.095854+00:00", "value": {"mitigation_remediation": ["Apply the latest patched Linux kernel that removes the faulty PTE_SHARED assignment for GCS mappings", "If an immediate upgrade is not possible, disable the GCS feature or ensure FEAT_LPA2 is turned off on the target device", "Verify that no custom PAGE_GCS macros remain in the kernel source and rebuild with the upstream patch set", "Monitor kernel logs for page\u2011fault crashes and investigate any occurrences as indicative of the issue"], "summary": {"action": "Apply patch", "impact": "Kernel crash due to incorrect page table attribute handling"}, "threat_synthesis": {"affected_systems": "All arm64 Linux kernel releases that have not incorporated the patch which clears the PTE_SHARED bits for GCS mappings are affected. The issue manifested in kernel 7.0.0\u2011rc1 running on a QEMU virtual machine with FEAT_LPA2 enabled, but any upstream kernel before the commit that disables the macro is vulnerable. Distributions that ship the old kernel code or custom builds that preserve the original _PAGE_GCS macros remain at risk.\n", "description_and_impact": "The flaw comes from the ARM64 Global Coherence Synchronization system in the Linux kernel. When the FEAT_LPA2 feature is active, the hardware repurposes bits 8\u20119 of a page table entry to hold share\u2011ability information derived from the target address. The kernel\u2019s existing macro for GCS mappings wrote a fixed 0b11 value into those bits, which conflicts with the hardware expectation and causes a translation fault that propagates into a kernel panic. This loss of availability is total: the system halts immediately upon the fault and requires a reboot to recover. The weakness is a misuse of architectural specifications for page table attributes, effectively an improper handling of critical kernel data structures.\n", "risk_and_exploitability": "The CVSS score is not published in the available data, but the denial\u2011of\u2011service nature of the crash gives the vulnerability a high risk rating. EPSS data is unavailable, and the flaw is not listed by CISA as a known exploited vulnerability, implying no public exploitation yet. Exploitation requires the ability to enable GCS while FEAT_LPA2 is active, which in practice means the attacker must have kernel or elevated privileges. Remote exploitation without such access is unlikely.\n"}}}}, "created": "2026-03-25T21:32:09.569965+00:00", "updated": "2026-03-25T21:32:09.569991+00:00", "vendors": [], "weaknesses": ["CWE-284"]}