arm64: io: Reject non-user protection in ioremap_prot()
Summary
| CVE | CVE-2026-98923 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-10-23 13:17:12 UTC |
|---|
| Updated | 2026-10-23 13:17:12 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
arm64: io: Reject non-user protection in ioremap_prot()
Mapping a stack-top page via /dev/mem with PROT_NONE and then
reading that process's /proc/<pid>/cmdline triggers a spurious WARN
in ioremap_prot() through generic_access_phys():
WARNING: ./arch/arm64/include/asm/io.h:275 at generic_access_phys
Call trace:
generic_access_phys+0x1c8/0x228 (P)
__access_remote_vm+0x2b4/0x398
access_remote_vm+0x14/0x30
get_mm_cmdline+0xf8/0x2a0
proc_pid_cmdline_read+0x68/0x120
generic_access_phys() passes the protection derived from the user PTE
to ioremap_prot(). On arm64, a PROT_NONE mapping is represented by a
present-invalid PTE, so pte_present() still returns true and the
protection reaches ioremap_prot().
A PROT_NONE mapping does not have PTE_USER, causing the existing
WARN_ON_ONCE() in ioremap_prot() to fire even though this is a valid
user mapping. Execute-only mappings have the same issue and must not
be readable through this path either.
ioremap_prot() should therefore reject protection values without
PTE_USER without warning. This makes the access fail cleanly for
PROT_NONE and execute-only mappings while retaining the existing
user-protection contract. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected 64858b76ec67c5fc40fef8ec1841fecb78c1ebde fddc90d4af4550af410f52d11bbf6b5f36443838 git |
Not specified |
| CNA |
Linux |
Linux |
affected eeecafce5afffb4da703666ebefbd4d6e2a5abf6 0b04af3d88bb7fc69b2d92457890608860e42365 git |
Not specified |
| CNA |
Linux |
Linux |
affected 3d64dcc0799c2d6921ba027716b7be721eb19fa8 b17aa4955e3a694c663ebe99626e4c76ca4f7cfb git |
Not specified |
| CNA |
Linux |
Linux |
affected 8f098037139b294050053123ab2bc0f819d08932 9b583795feb51f8d50203228d001760d1344ef01 git |
Not specified |
| CNA |
Linux |
Linux |
affected 8f098037139b294050053123ab2bc0f819d08932 bb756b11ad63832ebee58caf9e8f9381eaecff9f git |
Not specified |
| CNA |
Linux |
Linux |
affected d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a git |
Not specified |
| CNA |
Linux |
Linux |
affected 6.6.143 6.6.158 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.12.93 6.12.112 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.18.17 6.18.55 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.19.7 6.20 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 7.0 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.0 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.158 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.112 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.55 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.9 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/b17aa4955e3a694c663ebe99626e4c76ca4f7cfb |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/0b04af3d88bb7fc69b2d92457890608860e42365 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/9b583795feb51f8d50203228d001760d1344ef01 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/fddc90d4af4550af410f52d11bbf6b5f36443838 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/bb756b11ad63832ebee58caf9e8f9381eaecff9f |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.