LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23346: arm64: io: Extract user memory type in ioremap_prot()

In the Linux kernel, the following vulnerability has been resolved: arm64: io: Extract user memory type in ioremap_prot() The only caller of ioremap_prot() outside of the generic ioremap() implementation is generic_access_phys(), which passes a 'pgprot_t' value determined from the user mapping of the target 'pfn' being accessed by the kernel. On arm64, the 'pgprot_t' contains all of the non-address bits from the pte, including the permission controls, and so we end up returning a new user mapping from ioremap_prot() which faults when accessed from the kernel on systems with PAN: | Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000 | ... | Call trace: | __memcpy_fromio+0x80/0xf8 | generic_access_phys+0x20c/0x2b8 | __access_remote_vm+0x46c/0x5b8 | access_remote_vm+0x18/0x30 | environ_read+0x238/0x3e8 | vfs_read+0xe4/0x2b0 | ksys_read+0xcc/0x178 | __arm64_sys_read+0x4c/0x68 Extract only the memory type from the user 'pgprot_t' in ioremap_prot() and assert that we're being passed a user mapping, to protect us against any changes in future that may require additional handling. To avoid falsely flagging users of ioremap(), provide our own ioremap() macro which simply wraps __ioremap_prot().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-23346 is a Linux kernel arm64 issue where a kernel memory-mapping helper can reuse user permission bits incorrectly. On systems using PAN, this can cause a kernel fault during certain memory access paths. The public record shows a resolved kernel fix, but no CVSS score or active exploitation evidence.

Executive priority

Treat as a targeted kernel stability issue for arm64 fleets, not a confirmed internet-scale emergency. Prioritize systems supporting critical services, appliances, and embedded platforms where kernel crashes could cause downtime. Track vendor updates and patch through normal expedited kernel maintenance.

Technical view

On arm64, ioremap_prot() could receive a pgprot_t derived from a user mapping via generic_access_phys(). Because pgprot_t includes non-address permission bits, the kernel could create a mapping that faults when accessed under PAN. The fix extracts only the memory type from the user pgprot_t and adds assertions to constrain expected usage.

Likely exposure

Exposure appears limited to affected Linux kernel versions on arm64 systems, especially where PAN is present and the generic_access_phys()/remote memory access path is reachable. The source bundle lists affected Linux versions and stable commit references, but does not provide distribution-specific package status.

Exploitation context

No active exploitation is indicated in the provided sources, and the CVE is not marked KEV. The described impact is a kernel fault during read access, suggesting availability risk. Public sources do not establish privilege requirements, exploitability, or confidentiality/integrity impact.

Researcher notes

The public record lacks CVSS, CWE, and detailed threat model data. Analysis should focus on affected arm64 kernels, PAN behavior, and whether local interfaces can reach generic_access_phys() through legitimate kernel paths. Avoid assuming distribution exposure without vendor backport confirmation.

Mitigation direction

  • Check vendor advisories for your Linux distribution or appliance kernel.
  • Prioritize arm64 systems running affected kernel branches.
  • Update to a kernel containing the referenced stable fixes when available.
  • For managed devices, request firmware or kernel status from the vendor.

Validation and detection

  • Inventory arm64 Linux systems and kernel versions.
  • Compare installed kernels against vendor fixed packages or referenced stable commits.
  • Review crash logs for matching arm64 PAN kernel fault traces.
  • Confirm remediation through vendor package metadata or kernel changelog.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23346 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux893dea9ccd08dab924839354aba21d4ed7a9abc0, 893dea9ccd08dab924839354aba21d4ed7a9abc0, 893dea9ccd08dab924839354aba21d4ed7a9abc0, 893dea9ccd08dab924839354aba21d4ed7a9abc0, 893dea9ccd08dab924839354aba21d4ed7a9abc0unaffected
LinuxLinux6.0, 0, 6.6.143, 6.12.93, 6.18.17, 6.19.7, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.