CVE-2026-23345
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled
When FEAT_LPA2 is enabled, bits 8-9 of the PTE replace the shareability attribute with bits 50-51 of the output address. The _PAGE_GCS{,_RO} definitions include the PTE_SHARED bits as 0b11 (this matches the other _PAGE_* definitions) but using this macro directly leads to the following panic when enabling GCS on a system/model with LPA2:
Similarly to how the kernel handles protection_map[], use a gcs_page_prot variable to store the protection bits and clear PTE_SHARED if LPA2 is enabled.
Leer descripción completaMostrar menos
Also remove the unused PAGE_GCS{,_RO} macros.
Detalles técnicos trazas, registros y código del informe original
Unable to handle kernel paging request at virtual address fffff1ffc32d8008
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 52-bit VAs, pgdp=0000000060f4d000
[fffff1ffc32d8008] pgd=100000006184b003, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] SMP
CPU: 0 UID: 0 PID: 513 Comm: gcs_write_fault Tainted: G M 7.0.0-rc1 #1 PREEMPT
Tainted: [M]=MACHINE_CHECK
Hardware name: QEMU QEMU Virtual Machine, BIOS 2025.02-8+deb13u1 11/08/2025
pstate: 03402005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : zap_huge_pmd+0x168/0x468
lr : zap_huge_pmd+0x2c/0x468
sp : ffff800080beb660
x29: ffff800080beb660 x28: fff00000c2058180 x27: ffff800080beb898
x26: fff00000c2058180 x25: ffff800080beb820 x24: 00c800010b600f41
x23: ffffc1ffc30af1a8 x22: fff00000c2058180 x21: 0000ffff8dc00000
x20: fff00000c2bc6370 x19: ffff800080beb898 x18: ffff800080bebb60
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000007
x14: 000000000000000a x13: 0000aaaacbbbffff x12: 0000000000000000
x11: 0000ffff8ddfffff x10: 00000000000001fe x9 : 0000ffff8ddfffff
x8 : 0000ffff8de00000 x7 : 0000ffff8da00000 x6 : fff00000c2bc6370
x5 : 0000ffff8da00000 x4 : 000000010b600000 x3 : ffffc1ffc0000000
x2 : fff00000c2058180 x1 : fffff1ffc32d8000 x0 : 000000c00010b600
Call trace:
zap_huge_pmd+0x168/0x468 (P)
unmap_page_range+0xd70/0x1560
unmap_single_vma+0x48/0x80
unmap_vmas+0x90/0x180
unmap_region+0x88/0xe4
vms_complete_munmap_vmas+0xf8/0x1e0
do_vmi_align_munmap+0x158/0x180
do_vmi_munmap+0xac/0x160
__vm_munmap+0xb0/0x138
vm_munmap+0x14/0x20
gcs_free+0x70/0x80
mm_release+0x1c/0xc8
exit_mm_release+0x28/0x38
do_exit+0x190/0x8ec
do_group_exit+0x34/0x90
get_signal+0x794/0x858
arch_do_signal_or_restart+0x11c/0x3e0
exit_to_user_mode_loop+0x10c/0x17c
el0_da+0x8c/0x9c
el0t_64_sync_handler+0xd0/0xf0
el0t_64_sync+0x198/0x19c
Code: aa1603e2 d34cfc00 cb813001 8b011861 (f9400420)CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.12%
- Percentil entre todas las CVEs puntuadas: 2
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- NVD-CWE-noinfo
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-23345",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6497b66ba6945f142902c7e8fce86e47016ead1c",
"lessThan": "ca1684dd297bf0725c1d487cff80e615497accf6",
"versionType": "git"
},
{
"status": "affected",
"version": "6497b66ba6945f142902c7e8fce86e47016ead1c",
"lessThan": "1df3ef7e612d6ccbae5a48e1121553c47c2123d6",
"versionType": "git"
},
{
"status": "affected",
"version": "6497b66ba6945f142902c7e8fce86e47016ead1c",
"lessThan": "8a85b3131225a8c8143ba2ae29c0eef8c1f9117f",
"versionType": "git"
}
],
"programFiles": [
"arch/arm64/include/asm/pgtable-prot.h",
"arch/arm64/mm/mmap.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.13",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/arm64/include/asm/pgtable-prot.h",
"arch/arm64/mm/mmap.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-03-25T11:16:32.610",
"references": [
{
"url": "https://git.kernel.org/stable/c/1df3ef7e612d6ccbae5a48e1121553c47c2123d6",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8a85b3131225a8c8143ba2ae29c0eef8c1f9117f",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ca1684dd297bf0725c1d487cff80e615497accf6",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled\n\nWhen FEAT_LPA2 is enabled, bits 8-9 of the PTE replace the\nshareability attribute with bits 50-51 of the output address. The\n_PAGE_GCS{,_RO} definitions include the PTE_SHARED bits as 0b11 (this\nmatches the other _PAGE_* definitions) but using this macro directly\nleads to the following panic when enabling GCS on a system/model with\nLPA2:\n\n Unable to handle kernel paging request at virtual address fffff1ffc32d8008\n Mem abort info:\n ESR = 0x0000000096000004\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x04: level 0 translation fault\n Data abort info:\n ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n swapper pgtable: 4k pages, 52-bit VAs, pgdp=0000000060f4d000\n [fffff1ffc32d8008] pgd=100000006184b003, p4d=0000000000000000\n Internal error: Oops: 0000000096000004 [#1] SMP\n CPU: 0 UID: 0 PID: 513 Comm: gcs_write_fault Tainted: G M 7.0.0-rc1 #1 PREEMPT\n Tainted: [M]=MACHINE_CHECK\n Hardware name: QEMU QEMU Virtual Machine, BIOS 2025.02-8+deb13u1 11/08/2025\n pstate: 03402005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : zap_huge_pmd+0x168/0x468\n lr : zap_huge_pmd+0x2c/0x468\n sp : ffff800080beb660\n x29: ffff800080beb660 x28: fff00000c2058180 x27: ffff800080beb898\n x26: fff00000c2058180 x25: ffff800080beb820 x24: 00c800010b600f41\n x23: ffffc1ffc30af1a8 x22: fff00000c2058180 x21: 0000ffff8dc00000\n x20: fff00000c2bc6370 x19: ffff800080beb898 x18: ffff800080bebb60\n x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000007\n x14: 000000000000000a x13: 0000aaaacbbbffff x12: 0000000000000000\n x11: 0000ffff8ddfffff x10: 00000000000001fe x9 : 0000ffff8ddfffff\n x8 : 0000ffff8de00000 x7 : 0000ffff8da00000 x6 : fff00000c2bc6370\n x5 : 0000ffff8da00000 x4 : 000000010b600000 x3 : ffffc1ffc0000000\n x2 : fff00000c2058180 x1 : fffff1ffc32d8000 x0 : 000000c00010b600\n Call trace:\n zap_huge_pmd+0x168/0x468 (P)\n unmap_page_range+0xd70/0x1560\n unmap_single_vma+0x48/0x80\n unmap_vmas+0x90/0x180\n unmap_region+0x88/0xe4\n vms_complete_munmap_vmas+0xf8/0x1e0\n do_vmi_align_munmap+0x158/0x180\n do_vmi_munmap+0xac/0x160\n __vm_munmap+0xb0/0x138\n vm_munmap+0x14/0x20\n gcs_free+0x70/0x80\n mm_release+0x1c/0xc8\n exit_mm_release+0x28/0x38\n do_exit+0x190/0x8ec\n do_group_exit+0x34/0x90\n get_signal+0x794/0x858\n arch_do_signal_or_restart+0x11c/0x3e0\n exit_to_user_mode_loop+0x10c/0x17c\n el0_da+0x8c/0x9c\n el0t_64_sync_handler+0xd0/0xf0\n el0t_64_sync+0x198/0x19c\n Code: aa1603e2 d34cfc00 cb813001 8b011861 (f9400420)\n\nSimilarly to how the kernel handles protection_map[], use a\ngcs_page_prot variable to store the protection bits and clear PTE_SHARED\nif LPA2 is enabled.\n\nAlso remove the unused PAGE_GCS{,_RO} macros."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\narm64: gcs: No establecer PTE_SHARED en mapeos GCS si FEAT_LPA2 está habilitado\n\nCuando FEAT_LPA2 está habilitado, los bits 8-9 del PTE reemplazan el atributo de compartibilidad con los bits 50-51 de la dirección de salida. Las definiciones _PAGE_GCS{,_RO} incluyen los bits PTE_SHARED como 0b11 (esto coincide con las otras definiciones _PAGE_*) pero usar esta macro directamente lleva al siguiente pánico al habilitar GCS en un sistema/modelo con LPA2:\n\n Incapaz de manejar la solicitud de paginación del kernel en la dirección virtual fffff1ffc32d8008\n Información de aborto de memoria:\n ESR = 0x0000000096000004\n EC = 0x25: DABT (EL actual), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x04: fallo de traducción de nivel 0\n Información de aborto de datos:\n ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n tabla de páginas del swapper: páginas de 4k, VAs de 52 bits, pgdp=0000000060f4d000\n [fffff1ffc32d8008] pgd=100000006184b003, p4d=0000000000000000\n Error interno: Oops: 0000000096000004 [#1] SMP\n CPU: 0 UID: 0 PID: 513 Comm: gcs_write_fault Contaminado: G M 7.0.0-rc1 #1 PREEMPT\n Contaminado: [M]=MACHINE_CHECK\n Nombre del hardware: QEMU QEMU Máquina Virtual, BIOS 2025.02-8+deb13u1 11/08/2025\n pstate: 03402005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : zap_huge_pmd+0x168/0x468\n lr : zap_huge_pmd+0x2c/0x468\n sp : ffff800080beb660\n x29: ffff800080beb660 x28: fff00000c2058180 x27: ffff800080beb898\n x26: fff00000c2058180 x25: ffff800080beb820 x24: 00c800010b600f41\n x23: ffffc1ffc30af1a8 x22: fff00000c2058180 x21: 0000ffff8dc00000\n x20: fff00000c2bc6370 x19: ffff800080beb898 x18: ffff800080bebb60\n x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000007\n x14: 000000000000000a x13: 0000aaaacbbbffff x12: 0000000000000000\n x11: 0000ffff8ddfffff x10: 00000000000001fe x9 : 0000ffff8ddfffff\n x8 : 0000ffff8de00000 x7 : 0000ffff8da00000 x6 : fff00000c2bc6370\n x5 : 0000ffff8da00000 x4 : 000000010b600000 x3 : ffffc1ffc0000000\n x2 : fff00000c2058180 x1 : fffff1ffc32d8000 x0 : 000000c00010b600\n Traza de llamada:\n zap_huge_pmd+0x168/0x468 (P)\n unmap_page_range+0xd70/0x1560\n unmap_single_vma+0x48/0x80\n unmap_vmas+0x90/0x180\n unmap_region+0x88/0xe4\n vms_complete_munmap_vmas+0xf8/0x1e0\n do_vmi_align_munmap+0x158/0x180\n do_vmi_munmap+0xac/0x160\n __vm_munmap+0xb0/0x138\n vm_munmap+0x14/0x20\n gcs_free+0x70/0x80\n mm_release+0x1c/0xc8\n exit_mm_release+0x28/0x38\n do_exit+0x190/0x8ec\n do_group_exit+0x34/0x90\n get_signal+0x794/0x858\n arch_do_signal_or_restart+0x11c/0x3e0\n exit_to_user_mode_loop+0x10c/0x17c\n el0_da+0x8c/0x9c\n el0t_64_sync_handler+0xd0/0xf0\n el0t_64_sync+0x198/0x19c\n Código: aa1603e2 d34cfc00 cb813001 8b011861 (f9400420)\n\nDe manera similar a cómo el kernel maneja protection_map[], usar una variable gcs_page_prot para almacenar los bits de protección y borrar PTE_SHARED si LPA2 está habilitado.\n\nTambién eliminar las macros PAGE_GCS{,_RO} no utilizadas."
}
],
"lastModified": "2026-06-17T10:21:23.707",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "40E7536C-DA22-4B7D-9953-0343B4D9A3E6",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.13.1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.19"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5A3F9505-6B98-4269-8B81-127E55A1BF00"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}