CVE-2026-98923

arm64: io: Reject non-user protection in ioremap_prot()

State: Published
Severity: Not scored
Published: Oct 23, 2026
Updated: Oct 23, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

arm64: io: Reject non-user protection in ioremap_prot()

Mapping a stack-top page via /dev/mem with PROT_NONE and then reading that process's /proc/<pid>/cmdline triggers a spurious WARN in ioremap_prot() through generic_access_phys():

WARNING: ./arch/arm64/include/asm/io.h:275 at generic_access_phys Call trace: generic_access_phys+0x1c8/0x228 (P) __access_remote_vm+0x2b4/0x398 access_remote_vm+0x14/0x30 get_mm_cmdline+0xf8/0x2a0 proc_pid_cmdline_read+0x68/0x120

generic_access_phys() passes the protection derived from the user PTE to ioremap_prot(). On arm64, a PROT_NONE mapping is represented by a present-invalid PTE, so pte_present() still returns true and the protection reaches ioremap_prot().

A PROT_NONE mapping does not have PTE_USER, causing the existing WARN_ON_ONCE() in ioremap_prot() to fire even though this is a valid user mapping. Execute-only mappings have the same issue and must not be readable through this path either.

ioremap_prot() should therefore reject protection values without PTE_USER without warning. This makes the access fail cleanly for PROT_NONE and execute-only mappings while retaining the existing user-protection contract.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	64858b76ec67c5fc40fef8ec1841fecb78c1ebde to before fddc90d4af4550af410f52d11bbf6b5f36443838Affected eeecafce5afffb4da703666ebefbd4d6e2a5abf6 to before 0b04af3d88bb7fc69b2d92457890608860e42365Affected 3d64dcc0799c2d6921ba027716b7be721eb19fa8 to before b17aa4955e3a694c663ebe99626e4c76ca4f7cfbAffected 8f098037139b294050053123ab2bc0f819d08932 to before 9b583795feb51f8d50203228d001760d1344ef01Affected 8f098037139b294050053123ab2bc0f819d08932 to before bb756b11ad63832ebee58caf9e8f9381eaecff9fAffected d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2aAffected 6.6.143 to before 6.6.158Affected 6.12.93 to before 6.12.112Affected 6.18.17 to before 6.18.55Affected 6.19.7 to before 6.20Affected
LinuxLinux	7.0Affected before 7.0Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

64858b76ec67c5fc40fef8ec1841fecb78c1ebde to before fddc90d4af4550af410f52d11bbf6b5f36443838Affected
eeecafce5afffb4da703666ebefbd4d6e2a5abf6 to before 0b04af3d88bb7fc69b2d92457890608860e42365Affected
3d64dcc0799c2d6921ba027716b7be721eb19fa8 to before b17aa4955e3a694c663ebe99626e4c76ca4f7cfbAffected
8f098037139b294050053123ab2bc0f819d08932 to before 9b583795feb51f8d50203228d001760d1344ef01Affected
8f098037139b294050053123ab2bc0f819d08932 to before bb756b11ad63832ebee58caf9e8f9381eaecff9fAffected
d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2aAffected
6.6.143 to before 6.6.158Affected
6.12.93 to before 6.12.112Affected
6.18.17 to before 6.18.55Affected
6.19.7 to before 6.20Affected

LinuxLinux

7.0Affected
before 7.0Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.