CVE-2026-23067

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue involves a signedness bug in the arm lpae unmap() function within the io-pgtable-arm component of the Linux kernel. The function incorrectly returns a negative error code (-ENOENT) as a size t value, which is an unsigned type. This results in a corrupted value propagating through the call chain, potentially leading to an IOVA address overflow in the iommu unmap() loop and triggering a BUG ON condition in the iommu pgsize() function due to invalid address alignment. The fix involves returning 0 instead of -ENOENT, aligning the behavior with other io-pgtable implementations like io-pgtable-arm-v7s and io-pgtable-dart.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.