All vulnerabilities
CVE-2026-98923

Linux: arm64: io: Reject non-user protection in ioremap_prot()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in0b04af3d88bb7fc69b2d92457890608860e42365Also 9b583795feb51f8d50203228d001760d1344ef01, 6.6.158 and 3 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

arm64: io: Reject non-user protection in ioremap_prot()

Mapping a stack-top page via /dev/mem with PROT_NONE and then reading that process's /proc/<pid>/cmdline triggers a spurious WARN in ioremap_prot() through generic_access_phys():

WARNING: ./arch/arm64/include/asm/io.h:275 at generic_access_phys Call trace: generic_access_phys+0x1c8/0x228 (P) __access_remote_vm+0x2b4/0x398 access_remote_vm+0x14/0x30 get_mm_cmdline+0xf8/0x2a0 proc_pid_cmdline_read+0x68/0x120

generic_access_phys() passes the protection derived from the user PTE to ioremap_prot(). On arm64, a PROT_NONE mapping is represented by a present-invalid PTE, so pte_present() still returns true and the protection reaches ioremap_prot().

A PROT_NONE mapping does not have PTE_USER, causing the existing WARN_ON_ONCE() in ioremap_prot() to fire even though this is a valid user mapping. Execute-only mappings have the same issue and must not be readable through this path either.

ioremap_prot() should therefore reject protection values without PTE_USER without warning. This makes the access fail cleanly for PROT_NONE and execute-only mappings while retaining the existing user-protection contract.

Text from CVE List

Affected versions 17

  • Linuxaffected: 64858b76ec67c5fc40fef8ec1841fecb78c1ebde before fddc90d4af4550af410f52d11bbf6b5f36443838CVE List
  • Linuxaffected: eeecafce5afffb4da703666ebefbd4d6e2a5abf6 before 0b04af3d88bb7fc69b2d92457890608860e42365CVE List
  • Linuxaffected: 3d64dcc0799c2d6921ba027716b7be721eb19fa8 before b17aa4955e3a694c663ebe99626e4c76ca4f7cfbCVE List
  • Linuxaffected: 8f098037139b294050053123ab2bc0f819d08932 before 9b583795feb51f8d50203228d001760d1344ef01CVE List
  • Linuxaffected: 8f098037139b294050053123ab2bc0f819d08932 before bb756b11ad63832ebee58caf9e8f9381eaecff9fCVE List
  • Linuxaffected: d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2aCVE List
  • Linuxaffected: 6.6.143 before 6.6.158CVE List
  • Linuxaffected: 6.12.93 before 6.12.112CVE List
  • Linuxaffected: 6.18.17 before 6.18.55CVE List
  • Linuxaffected: 6.19.7 before 6.20CVE List
  • Linuxaffected: 7.0CVE List
  • Linuxunaffected: all versions before 7.0CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5