Linux kernel (drivers/iommu): The ARM long-descriptor unmap path returns a negative errno through an unsigned size_t

CVSS 6.2CVE-2026-23067Kernel, userspace & hypervisorcurated

Impact

The ARM long-descriptor unmap path returns a negative errno through an unsigned size_t, so the caller is told roughly 2^64 bytes were unmapped. That value is added to the IOVA in the unmap loop, overflowing the address and hitting a BUG_ON - a kernel panic that takes every tenant on the node with it - while the unmap itself walks into addresses that were never part of the request.

Who can reach it

Reached when an unmap request covers a page-table entry that is already absent. On a passthrough node the unmap originates from a tenant's VMM through vfio or iommufd, though the upper layers normally track mapped areas well enough that hitting an absent entry means state is already inconsistent (a WARN fires first). arm64 hosts using io-pgtable-arm, i.e. SMMUv3 on Grace-class GPU nodes. x86 is unaffected.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. No practical interim control on affected arm64 nodes beyond patching.

References

https://git.kernel.org/stable/c/41ec6988547819756fb65e94fc24f3e0dddf84ac https://git.kernel.org/stable/c/374e7af67d9d9d6103c2cfc8eb32abfecf3a2fd8 https://nvd.nist.gov/vuln/detail/CVE-2026-23067

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.