CVE-2026-98923
Description
In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremap_prot() Mapping a stack-top page via /dev/mem with PROT_NONE and then reading that process's /proc/<pid>/cmdline triggers a spurious WARN in ioremap_prot() through generic_access_phys(): WARNING: ./arch/arm64/include/asm/io.h:275 at generic_access_phys Call trace: generic_access_phys+0x1c8/0x228 (P) __access_remote_vm+0x2b4/0x398 access_remote_vm+0x14/0x30 get_mm_cmdline+0xf8/0x2a0 proc_pid_cmdline_read+0x68/0x120 generic_access_phys() passes the protection derived from the user PTE to ioremap_prot(). On arm64, a PROT_NONE mapping is represented by a present-invalid PTE, so pte_present() still returns true and the protection reaches ioremap_prot(). A PROT_NONE mapping does not have PTE_USER, causing the existing WARN_ON_ONCE() in ioremap_prot() to fire even though this is a valid user mapping. Execute-only mappings have the same issue and must not be readable through this path either. ioremap_prot() should therefore reject protection values without PTE_USER without warning. This makes the access fail cleanly for PROT_NONE and execute-only mappings while retaining the existing user-protection contract.
How to fix
- Linux Linuxfddc90d4af4550af410f52d11bbf6b5f36443838, 0b04af3d88bb7fc69b2d92457890608860e42365, b17aa4955e3a694c663ebe99626e4c76ca4f7cfb, 9b583795feb51f8d50203228d001760d1344ef01, bb756b11ad63832ebee58caf9e8f9381eaecff9f, 6.6.158, 6.12.112, 6.18.55, 6.20 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 64858b76ec67c5fc40fef8ec1841fecb78c1ebde ≤ v < fddc90d4af4550af410f52d11bbf6b5f36443838, eeecafce5afffb4da703666ebefbd4d6e2a5abf6 ≤ v < 0b04af3d88bb7fc69b2d92457890608860e42365, 3d64dcc0799c2d6921ba027716b7be721eb19fa8 ≤ v < b17aa4955e3a694c663ebe99626e4c76ca4f7cfb, 8f098037139b294050053123ab2bc0f819d08932 ≤ v < 9b583795feb51f8d50203228d001760d1344ef01, 8f098037139b294050053123ab2bc0f819d08932 ≤ v < bb756b11ad63832ebee58caf9e8f9381eaecff9f, d1ad8fe7f72d73e1617bac79f2ec7a3bedf47e2a, 6.6.143 ≤ v < 6.6.158, 6.12.93 ≤ v < 6.12.112, 6.18.17 ≤ v < 6.18.55, 6.19.7 ≤ v < 6.20, 7.0 | fddc90d4af4550af410f52d11bbf6b5f36443838, 0b04af3d88bb7fc69b2d92457890608860e42365, b17aa4955e3a694c663ebe99626e4c76ca4f7cfb, 9b583795feb51f8d50203228d001760d1344ef01, bb756b11ad63832ebee58caf9e8f9381eaecff9f, 6.6.158, 6.12.112, 6.18.55, 6.20 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.