Access of Resource Using Incompatible Type ('Type Confusion') The advisory has been revoked - it doesn't affect any version of package kernel-modules-internal (opens in a new tab)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RHEL10-KERNELMODULESINTERNAL-21844902
- published30 Oct 2026
- disclosed25 Mar 2026
Introduced: 25 Mar 2026
CVE-2026-23346 (opens in a new tab)Amendment
The Red Hat security team deemed this advisory irrelevant for RHEL:10.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-modules-internal package and not the kernel-modules-internal package as distributed by RHEL.
In the Linux kernel, the following vulnerability has been resolved:
arm64: io: Extract user memory type in ioremap_prot()
The only caller of ioremap_prot() outside of the generic ioremap() implementation is generic_access_phys(), which passes a 'pgprot_t' value determined from the user mapping of the target 'pfn' being accessed by the kernel. On arm64, the 'pgprot_t' contains all of the non-address bits from the pte, including the permission controls, and so we end up returning a new user mapping from ioremap_prot() which faults when accessed from the kernel on systems with PAN:
| Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000 | ... | Call trace: | __memcpy_fromio+0x80/0xf8 | generic_access_phys+0x20c/0x2b8 | __access_remote_vm+0x46c/0x5b8 | access_remote_vm+0x18/0x30 | environ_read+0x238/0x3e8 | vfs_read+0xe4/0x2b0 | ksys_read+0xcc/0x178 | __arm64_sys_read+0x4c/0x68
Extract only the memory type from the user 'pgprot_t' in ioremap_prot() and assert that we're being passed a user mapping, to protect us against any changes in future that may require additional handling. To avoid falsely flagging users of ioremap(), provide our own ioremap() macro which simply wraps __ioremap_prot().
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2451236
- https://access.redhat.com/security/cve/CVE-2026-23346
- https://git.kernel.org/stable/c/3d64dcc0799c2d6921ba027716b7be721eb19fa8
- https://git.kernel.org/stable/c/8f098037139b294050053123ab2bc0f819d08932
- https://git.kernel.org/stable/c/d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a
- https://git.kernel.org/stable/c/eeecafce5afffb4da703666ebefbd4d6e2a5abf6
- https://git.kernel.org/stable/c/64858b76ec67c5fc40fef8ec1841fecb78c1ebde