# CVE-2026-23345: linux: In the Linux kernel, the following vulnerability has been resolved: arm64: gcs: Do not set PTE_SHARED on GCS mapping... CVE-2026-23345 is fixed in 23 products on 1 platform, first by DEBIAN-CVE-2026-23345, released March 25, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-23345 - Priority: Routine - CVSS: 5.5 (medium) - EPSS: 0.0013 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Mar 25, 2026 ## Description In the Linux kernel, the following vulnerability has been resolved: arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled When FEAT_LPA2 is enabled, bits 8-9 of the PTE replace the shareability attribute with bits 50-51 of the output address. The _PAGE_GCS{,_RO} definitions include the PTE_SHARED bits as 0b11 (this matches the other _PAGE_* definitions) but using this macro directly leads to the following panic when enabling GCS on a system/model with LPA2: Unable to handle kernel paging request at virtual address fffff1ffc32d8008 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 52-bit VAs, pgdp=0000000060f4d000 [fffff1ffc32d8008] pgd=100000006184b003, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 0 UID: 0 PID: 513 Comm: gcs_write_fault Tainted: G M 7.0.0-rc1 #1 PREEMPT Tainted: [M]=MACHINE_CHECK Hardware name: QEMU QEMU Virtual Machine, BIOS 2025.02-8+deb13u1 11/08/2025 pstate: 03402005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : zap_huge_pmd+0x168/0x468 lr : zap_huge_pmd+0x2c/0x468 sp : ffff800080beb660 x29: ffff800080beb660 x28: fff00000c2058180 x27: ffff800080beb898 x26: fff00000c2058180 x25: ffff800080beb820 x24: 00c800010b600f41 x23: ffffc1ffc30af1a8 x22: fff00000c2058180 x21: 0000ffff8dc00000 x20: fff00000c2bc6370 x19: ffff800080beb898 x18: ffff800080bebb60 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000007 x14: 000000000000000a x13: 0000aaaacbbbffff x12: 0000000000000000 x11: 0000ffff8ddfffff x10: 00000000000001fe x9 : 0000ffff8ddfffff x8 : 0000ffff8de00000 x7 : 0000ffff8da00000 x6 : fff00000c2bc6370 x5 : 0000ffff8da00000 x4 : 000000010b600000 x3 : ffffc1ffc0000000 x2 : fff00000c2058180 x1 : fffff1ffc32d8000 x0 : 000000c00010b600 Call trace: zap_huge_pmd+0x168/0x468 (P) unmap_page_range+0xd70/0x1560 unmap_single_vma+0x48/0x80 unmap_vmas+0x90/0x180 unmap_region+0x88/0xe4 vms_complete_munmap_vmas+0xf8/0x1e0 do_vmi_align_munmap+0x158/0x180 do_vmi_munmap+0xac/0x160 __vm_munmap+0xb0/0x138 vm_munmap+0x14/0x20 gcs_free+0x70/0x80 mm_release+0x1c/0xc8 exit_mm_release+0x28/0x38 do_exit+0x190/0x8ec do_group_exit+0x34/0x90 get_signal+0x794/0x858 arch_do_signal_or_restart+0x11c/0x3e0 exit_to_user_mode_loop+0x10c/0x17c el0_da+0x8c/0x9c el0t_64_sync_handler+0xd0/0xf0 el0t_64_sync+0x198/0x19c Code: aa1603e2 d34cfc00 cb813001 8b011861 (f9400420) Similarly to how the kernel handles protection_map[], use a gcs_page_prot variable to store the protection bits and clear PTE_SHARED if LPA2 is enabled. Also remove the unused PAGE_GCS{,_RO} macros. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | bpftool6.18 amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | bpftool6.18-debuginfo amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel-livepatch-6.18.20-20.229 amzn 2023 | 1:1.0-0.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel6.18 amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel6.18-debuginfo amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel6.18-debuginfo-common-aarch64 amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel6.18-debuginfo-common-x86_64 amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel6.18-devel amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel6.18-headers amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel6.18-libbpf amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel6.18-libbpf-debuginfo amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel6.18-libbpf-devel amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel6.18-libbpf-static amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel6.18-modules-extra amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel6.18-modules-extra-common amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel6.18-tools amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel6.18-tools-debuginfo amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | kernel6.18-tools-devel amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | linux Debian 14 | 6.19.8-1 | [DEBIAN-CVE-2026-23345](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23345.md) | Mar 25, 2026 | | Linux | perf6.18 amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | perf6.18-debuginfo amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | python3-perf6.18 amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | | Linux | python3-perf6.18-debuginfo amzn 2023 | 1:6.18.20-20.229.amzn2023 | [ALAS2023-2026-1596](https://patchblox.com/security/data/fix/linux/alas2023-2026-1596.md) | Apr 27, 2026 | --- Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.