CVE-2026-23346

What the vulnerability is

CVE-2026-23346 is a bug in the Linux kernel's ioremap_prot() function on arm64 architectures. The function incorrectly passes the entire pgprot_t from a user page table entry (PTE) when creating a kernel mapping for physical memory access via generic_access_phys(). On systems with Privileged Access Never (PAN) enabled, this results in a kernel mapping with user permissions, causing a fault when the kernel attempts to read from that memory [1].

How it is exploited

The attack vector requires the ability to trigger generic_access_phys() through interfaces like /proc/pid/mem or ptrace (e.g., reading /proc/pid/environ). An attacker must have local access and the ability to read or write memory of another process. The kernel panic occurs when the kernel tries to perform a read from the mapped I/O region, as the mapping lacks kernel-read permission due to the user permission bits inherited from the user PTE [1].

Impact

A local attacker can cause a kernel panic (denial of service) by inducing the kernel to access a user-mapped physical address via generic_access_phys(). The bug manifests as an "Unable to handle kernel read from unreadable memory" error, leading to system crash. No privilege escalation is reported [1].

Mitigation

The fix, applied to multiple stable kernel branches, extracts only the memory type attributes from the user pgprot_t and asserts that the mapping originated from a user page. The patches also define a new ioremap() macro to avoid false positives. Users should update to kernels containing commits d1ad8fe7f72d, 3d64dcc0799c, or 8f098037139b [1][2][3].