CVE-2026-98923

In the Linux kernel, the following vulnerability has been resolved:

arm64: io: Reject non-user protection in ioremap prot()

Mapping a stack-top page via /dev/mem with PROT NONE and then reading that process's /proc//cmdline triggers a spurious WARN in ioremap prot() through generic access phys():

WARNING: ./arch/arm64/include/asm/io.h:275 at generic access phys Call trace: generic access phys+0x1c8/0x228 (P) access remote vm+0x2b4/0x398 access remote vm+0x14/0x30 get mm cmdline+0xf8/0x2a0 proc pid cmdline read+0x68/0x120

generic access phys() passes the protection derived from the user PTE to ioremap prot(). On arm64, a PROT NONE mapping is represented by a present-invalid PTE, so pte present() still returns true and the protection reaches ioremap prot().

A PROT NONE mapping does not have PTE USER, causing the existing WARN ON ONCE() in ioremap prot() to fire even though this is a valid user mapping. Execute-only mappings have the same issue and must not be readable through this path either.

ioremap prot() should therefore reject protection values without PTE USER without warning. This makes the access fail cleanly for PROT NONE and execute-only mappings while retaining the existing user-protection contract.