Executive brief
A vulnerability in the Linux kernel for ARM64 systems could allow a local user to cause a system crash. The issue occurs when the kernel incorrectly handles memory permissions while trying to access certain physical memory locations, leading to a kernel fault. This primarily impacts system availability and could disrupt operations or lead to a denial-of-service on affected hardware.
Technical details
A vulnerability in the arm64 architecture implementation of the Linux kernel involves the ioremap_prot() function. The root cause is that ioremap_prot() (called via generic_access_phys()) incorrectly includes non-address bits from the page table entry (PTE), such as user-space permission controls, when creating kernel mappings. On systems with Privileged Access Never (PAN) enabled, the kernel triggers a fault when attempting to access these mappings because they are flagged with user permissions. An attacker with local access could potentially trigger this condition to cause a kernel panic (Denial of Service). The fix involves extracting only the memory type attributes from the user pgprot_t and ensuring kernel-appropriate permissions are applied. Patches have been released for various stable branches including 6.18.x and 6.19.x.
Affected products
- Linux Linux Kernel 6.0.1 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-03-25: disclosed
- 2026-03-25: advisory
- 2026-03-12: patched: Commit merged into stable branches.