Linux Kernel arm64 ioremap_prot() Rejects Non-User PROT_NONE/Exec Mappings
CVE-2026-98923 Published on October 23, 2026
arm64: io: Reject non-user protection in ioremap_prot()
In the Linux kernel, the following vulnerability has been resolved:
arm64: io: Reject non-user protection in ioremap_prot()
Mapping a stack-top page via /dev/mem with PROT_NONE and then
reading that process's /proc/<pid>/cmdline triggers a spurious WARN
in ioremap_prot() through generic_access_phys():
WARNING: ./arch/arm64/include/asm/io.h:275 at generic_access_phys
Call trace:
generic_access_phys+0x1c8/0x228 (P)
__access_remote_vm+0x2b4/0x398
access_remote_vm+0x14/0x30
get_mm_cmdline+0xf8/0x2a0
proc_pid_cmdline_read+0x68/0x120
generic_access_phys() passes the protection derived from the user PTE
to ioremap_prot(). On arm64, a PROT_NONE mapping is represented by a
present-invalid PTE, so pte_present() still returns true and the
protection reaches ioremap_prot().
A PROT_NONE mapping does not have PTE_USER, causing the existing
WARN_ON_ONCE() in ioremap_prot() to fire even though this is a valid
user mapping. Execute-only mappings have the same issue and must not
be readable through this path either.
ioremap_prot() should therefore reject protection values without
PTE_USER without warning. This makes the access fail cleanly for
PROT_NONE and execute-only mappings while retaining the existing
user-protection contract.
Products Associated with CVE-2026-98923
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
Linux:- Version 64858b76ec67c5fc40fef8ec1841fecb78c1ebde and below fddc90d4af4550af410f52d11bbf6b5f36443838 is affected.
- Version eeecafce5afffb4da703666ebefbd4d6e2a5abf6 and below 0b04af3d88bb7fc69b2d92457890608860e42365 is affected.
- Version 3d64dcc0799c2d6921ba027716b7be721eb19fa8 and below b17aa4955e3a694c663ebe99626e4c76ca4f7cfb is affected.
- Version 8f098037139b294050053123ab2bc0f819d08932 and below 9b583795feb51f8d50203228d001760d1344ef01 is affected.
- Version 8f098037139b294050053123ab2bc0f819d08932 and below bb756b11ad63832ebee58caf9e8f9381eaecff9f is affected.
- Version d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a is affected.
- Version 6.6.143 and below 6.6.158 is affected.
- Version 6.12.93 and below 6.12.112 is affected.
- Version 6.18.17 and below 6.18.55 is affected.
- Version 6.19.7 and below 6.20 is affected.
- Version 7.0 is affected.
- Before 7.0 is unaffected.
- Version 6.6.158, <= 6.6.* is unaffected.
- Version 6.12.112, <= 6.12.* is unaffected.
- Version 6.18.55, <= 6.18.* is unaffected.
- Version 7.2.9, <= 7.2.* is unaffected.
- Version 7.3, <= * is unaffected.