CVE-2026-98923
Received
Received - Intake
arm64 io: Reject non-user protection in ioremap_prot
Vulnerability report for CVE-2026-98923, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-23
Last updated on: 2026-10-23
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
arm64: io: Reject non-user protection in ioremap_prot()
Mapping a stack-top page via /dev/mem with PROT_NONE and then
reading that process's /proc/<pid>/cmdline triggers a spurious WARN
in ioremap_prot() through generic_access_phys():
WARNING: ./arch/arm64/include/asm/io.h:275 at generic_access_phys
Call trace:
generic_access_phys+0x1c8/0x228 (P)
__access_remote_vm+0x2b4/0x398
access_remote_vm+0x14/0x30
get_mm_cmdline+0xf8/0x2a0
proc_pid_cmdline_read+0x68/0x120
generic_access_phys() passes the protection derived from the user PTE
to ioremap_prot(). On arm64, a PROT_NONE mapping is represented by a
present-invalid PTE, so pte_present() still returns true and the
protection reaches ioremap_prot().
A PROT_NONE mapping does not have PTE_USER, causing the existing
WARN_ON_ONCE() in ioremap_prot() to fire even though this is a valid
user mapping. Execute-only mappings have the same issue and must not
be readable through this path either.
ioremap_prot() should therefore reject protection values without
PTE_USER without warning. This makes the access fail cleanly for
PROT_NONE and execute-only mappings while retaining the existing
user-protection contract.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 64858b76ec67c5fc40fef8ec1841fecb78c1ebde |
| Linux | Linux | eeecafce5afffb4da703666ebefbd4d6e2a5abf6 |
| Linux | Linux | 3d64dcc0799c2d6921ba027716b7be721eb19fa8 |
| Linux | Linux | 8f098037139b294050053123ab2bc0f819d08932 |
| Linux | Linux | 8f098037139b294050053123ab2bc0f819d08932 |
| Linux | Linux | d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a |
| Linux | Linux | 6.6.143 |
| Linux | Linux | 6.12.93 |
| Linux | Linux | 6.18.17 |
| Linux | Linux | 6.19.7 |
| Linux | Linux | 7.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
