{"id":"CVE-2026-98923","revision":"bc47e46024694de8beb1f96a6bdbf12d","records":[{"revision":"bc47e46024694de8beb1f96a6bdbf12d","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-98923","aliases":[],"title":"arm64: io: Reject non-user protection in ioremap_prot()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: io: Reject non-user protection in ioremap_prot()\n\nMapping a stack-top page via /dev/mem with PROT_NONE and then\nreading that process's /proc/<pid>/cmdline triggers a spurious WARN\nin ioremap_prot() through generic_access_phys():\n\n  WARNING: ./arch/arm64/include/asm/io.h:275 at generic_access_phys\n  Call trace:\n    generic_access_phys+0x1c8/0x228 (P)\n    __access_remote_vm+0x2b4/0x398\n    access_remote_vm+0x14/0x30\n    get_mm_cmdline+0xf8/0x2a0\n    proc_pid_cmdline_read+0x68/0x120\n\ngeneric_access_phys() passes the protection derived from the user PTE\nto ioremap_prot(). On arm64, a PROT_NONE mapping is represented by a\npresent-invalid PTE, so pte_present() still returns true and the\nprotection reaches ioremap_prot().\n\nA PROT_NONE mapping does not have PTE_USER, causing the existing\nWARN_ON_ONCE() in ioremap_prot() to fire even though this is a valid\nuser mapping. Execute-only mappings have the same issue and must not\nbe readable through this path either.\n\nioremap_prot() should therefore reject protection values without\nPTE_USER without warning. This makes the access fail cleanly for\nPROT_NONE and execute-only mappings while retaining the existing\nuser-protection contract.","state":0,"publishedAt":"2026-10-23T12:03:28.027+00:00","modifiedAt":"2026-10-23T12:05:45.179+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/arm64/include/asm/io.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"64858b76ec67c5fc40fef8ec1841fecb78c1ebde\",\n                            \"lessThan\": \"fddc90d4af4550af410f52d11bbf6b5f36443838\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eeecafce5afffb4da703666ebefbd4d6e2a5abf6\",\n                            \"lessThan\": \"0b04af3d88bb7fc69b2d92457890608860e42365\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3d64dcc0799c2d6921ba027716b7be721eb19fa8\",\n                            \"lessThan\": \"b17aa4955e3a694c663ebe99626e4c76ca4f7cfb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8f098037139b294050053123ab2bc0f819d08932\",\n                            \"lessThan\": \"9b583795feb51f8d50203228d001760d1344ef01\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8f098037139b294050053123ab2bc0f819d08932\",\n                            \"lessThan\": \"bb756b11ad63832ebee58caf9e8f9381eaecff9f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.6.143\",\n                            \"lessThan\": \"6.6.158\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.93\",\n                            \"lessThan\": \"6.12.112\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.17\",\n                            \"lessThan\": \"6.18.55\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.7\",\n                            \"lessThan\": \"6.20\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/arm64/include/asm/io.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/fddc90d4af4550af410f52d11bbf6b5f36443838","https://git.kernel.org/stable/c/0b04af3d88bb7fc69b2d92457890608860e42365","https://git.kernel.org/stable/c/b17aa4955e3a694c663ebe99626e4c76ca4f7cfb","https://git.kernel.org/stable/c/9b583795feb51f8d50203228d001760d1344ef01","https://git.kernel.org/stable/c/bb756b11ad63832ebee58caf9e8f9381eaecff9f"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98923","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98923","identifiers":["CVE-2026-98923"]},"retained":false,"historicalAffected":[]}],"coverage":[]}