{"id":"CVE-2026-98923","title":"arm64: io: Reject non-user protection in ioremap_prot()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: io: Reject non-user protection in ioremap_prot()\n\nMapping a stack-top page via /dev/mem with PROT_NONE and then\nreading that process's /proc/<pid>/cmdline trigge…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 64858b76ec67c5fc40fef8ec1841fecb78c1ebde < fddc90d4af4550af410f52d11bbf6b5f36443838","Linux >= eeecafce5afffb4da703666ebefbd4d6e2a5abf6 < 0b04af3d88bb7fc69b2d92457890608860e42365","Linux >= 3d64dcc0799c2d6921ba027716b7be721eb19fa8 < b17aa4955e3a694c663ebe99626e4c76ca4f7cfb","Linux >= 8f098037139b294050053123ab2bc0f819d08932 < 9b583795feb51f8d50203228d001760d1344ef01","Linux >= 8f098037139b294050053123ab2bc0f819d08932 < bb756b11ad63832ebee58caf9e8f9381eaecff9f","Linux d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a","Linux >= 6.6.143 < 6.6.158","Linux >= 6.12.93 < 6.12.112","Linux >= 6.18.17 < 6.18.55","Linux >= 6.19.7 < 6.20","Linux 7.0"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:05:45.179Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98923","references":[{"url":"https://git.kernel.org/stable/c/fddc90d4af4550af410f52d11bbf6b5f36443838"},{"url":"https://git.kernel.org/stable/c/0b04af3d88bb7fc69b2d92457890608860e42365"},{"url":"https://git.kernel.org/stable/c/b17aa4955e3a694c663ebe99626e4c76ca4f7cfb"},{"url":"https://git.kernel.org/stable/c/9b583795feb51f8d50203228d001760d1344ef01"},{"url":"https://git.kernel.org/stable/c/bb756b11ad63832ebee58caf9e8f9381eaecff9f"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.567Z","slug":"CVE-2026-98923","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narm64: io: Reject non-user protection in ioremap_prot()\n\nMapping a stack-top page via /dev/mem with PROT_NONE and then\nreading that process's /proc/<pid>/cmdline triggers a spurious WARN\nin ioremap_prot() through generic_access_phys():\n\n  WARNING: ./arch/arm64/include/asm/io.h:275 at generic_access_phys\n  Call trace:\n    generic_access_phys+0x1c8/0x228 (P)\n    __access_remote_vm+0x2b4/0x398\n    access_remote_vm+0x14/0x30\n    get_mm_cmdline+0xf8/0x2a0\n    proc_pid_cmdline_read+0x68/0x120\n\ngeneric_access_phys() passes the protection derived from the user PTE\nto ioremap_prot(). On arm64, a PROT_NONE mapping is represented by a\npresent-invalid PTE, so pte_present() still returns true and the\nprotection reaches ioremap_prot().\n\nA PROT_NONE mapping does not have PTE_USER, causing the existing\nWARN_ON_ONCE() in ioremap_prot() to fire even though this is a valid\nuser mapping. Execute-only mappings have the same issue and must not\nbe readable through this path either.\n\nioremap_prot() should therefore reject protection values without\nPTE_USER without warning. This makes the access fail cleanly for\nPROT_NONE and execute-only mappings while retaining the existing\nuser-protection contract.\n\n## Affected\n\n- `Linux >= 64858b76ec67c5fc40fef8ec1841fecb78c1ebde < fddc90d4af4550af410f52d11bbf6b5f36443838`\n- `Linux >= eeecafce5afffb4da703666ebefbd4d6e2a5abf6 < 0b04af3d88bb7fc69b2d92457890608860e42365`\n- `Linux >= 3d64dcc0799c2d6921ba027716b7be721eb19fa8 < b17aa4955e3a694c663ebe99626e4c76ca4f7cfb`\n- `Linux >= 8f098037139b294050053123ab2bc0f819d08932 < 9b583795feb51f8d50203228d001760d1344ef01`\n- `Linux >= 8f098037139b294050053123ab2bc0f819d08932 < bb756b11ad63832ebee58caf9e8f9381eaecff9f`\n- `Linux d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a`\n- `Linux >= 6.6.143 < 6.6.158`\n- `Linux >= 6.12.93 < 6.12.112`\n- `Linux >= 6.18.17 < 6.18.55`\n- `Linux >= 6.19.7 < 6.20`\n- `Linux 7.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}