---
id: CVE-2026-98923
title: 'arm64: io: Reject non-user protection in ioremap_prot()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  arm64: io: Reject non-user protection in ioremap_prot()

  Mapping a stack-top page via /dev/mem with PROT_NONE and then
  reading that process's /proc/<pid>/cmdline trigge…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 64858b76ec67c5fc40fef8ec1841fecb78c1ebde <
    fddc90d4af4550af410f52d11bbf6b5f36443838
  - >-
    Linux >= eeecafce5afffb4da703666ebefbd4d6e2a5abf6 <
    0b04af3d88bb7fc69b2d92457890608860e42365
  - >-
    Linux >= 3d64dcc0799c2d6921ba027716b7be721eb19fa8 <
    b17aa4955e3a694c663ebe99626e4c76ca4f7cfb
  - >-
    Linux >= 8f098037139b294050053123ab2bc0f819d08932 <
    9b583795feb51f8d50203228d001760d1344ef01
  - >-
    Linux >= 8f098037139b294050053123ab2bc0f819d08932 <
    bb756b11ad63832ebee58caf9e8f9381eaecff9f
  - Linux d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a
  - Linux >= 6.6.143 < 6.6.158
  - Linux >= 6.12.93 < 6.12.112
  - Linux >= 6.18.17 < 6.18.55
  - Linux >= 6.19.7 < 6.20
  - Linux 7.0
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:05:45.179Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98923'
references:
  - url: 'https://git.kernel.org/stable/c/fddc90d4af4550af410f52d11bbf6b5f36443838'
  - url: 'https://git.kernel.org/stable/c/0b04af3d88bb7fc69b2d92457890608860e42365'
  - url: 'https://git.kernel.org/stable/c/b17aa4955e3a694c663ebe99626e4c76ca4f7cfb'
  - url: 'https://git.kernel.org/stable/c/9b583795feb51f8d50203228d001760d1344ef01'
  - url: 'https://git.kernel.org/stable/c/bb756b11ad63832ebee58caf9e8f9381eaecff9f'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.567Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

arm64: io: Reject non-user protection in ioremap_prot()

Mapping a stack-top page via /dev/mem with PROT_NONE and then
reading that process's /proc/<pid>/cmdline triggers a spurious WARN
in ioremap_prot() through generic_access_phys():

  WARNING: ./arch/arm64/include/asm/io.h:275 at generic_access_phys
  Call trace:
    generic_access_phys+0x1c8/0x228 (P)
    __access_remote_vm+0x2b4/0x398
    access_remote_vm+0x14/0x30
    get_mm_cmdline+0xf8/0x2a0
    proc_pid_cmdline_read+0x68/0x120

generic_access_phys() passes the protection derived from the user PTE
to ioremap_prot(). On arm64, a PROT_NONE mapping is represented by a
present-invalid PTE, so pte_present() still returns true and the
protection reaches ioremap_prot().

A PROT_NONE mapping does not have PTE_USER, causing the existing
WARN_ON_ONCE() in ioremap_prot() to fire even though this is a valid
user mapping. Execute-only mappings have the same issue and must not
be readable through this path either.

ioremap_prot() should therefore reject protection values without
PTE_USER without warning. This makes the access fail cleanly for
PROT_NONE and execute-only mappings while retaining the existing
user-protection contract.

## Affected

- `Linux >= 64858b76ec67c5fc40fef8ec1841fecb78c1ebde < fddc90d4af4550af410f52d11bbf6b5f36443838`
- `Linux >= eeecafce5afffb4da703666ebefbd4d6e2a5abf6 < 0b04af3d88bb7fc69b2d92457890608860e42365`
- `Linux >= 3d64dcc0799c2d6921ba027716b7be721eb19fa8 < b17aa4955e3a694c663ebe99626e4c76ca4f7cfb`
- `Linux >= 8f098037139b294050053123ab2bc0f819d08932 < 9b583795feb51f8d50203228d001760d1344ef01`
- `Linux >= 8f098037139b294050053123ab2bc0f819d08932 < bb756b11ad63832ebee58caf9e8f9381eaecff9f`
- `Linux d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a`
- `Linux >= 6.6.143 < 6.6.158`
- `Linux >= 6.12.93 < 6.12.112`
- `Linux >= 6.18.17 < 6.18.55`
- `Linux >= 6.19.7 < 6.20`
- `Linux 7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.