CVE-2026-98923 arm64: io: Reject non-user protection in ioremap_prot()
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-98923?
CVE-2026-98923 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
arm64: io: Reject non-user protection in ioremap_prot()
Mapping a stack-top page via /dev/mem with PROT_NONE and then reading that process's /proc/<pid>/cmdline triggers a spurious WARN in ioremap_prot() through generic_access_phys():
WARNING: ./arch/arm64/include/asm/io.h:275 at generic_access_phys Call trace: generic_access_phys+0x1c8/0x228 (P) __access_remote_vm+0x2b4/0x398 access_remote_vm+0x14/0x30 get_mm_cmdline+0xf8/0x2a0 proc_pid_cmdline_read+0x68/0x120
generic_access_phys() passes the protection derived from the user PTE to ioremap_prot(). On arm64, a PROT_NONE mapping is represented by a present-invalid PTE, so pte_present() still returns true and the protection reaches ioremap_prot().
A PROT_NONE mapping does not have PTE_USER, causing the existing WARN_ON_ONCE() in ioremap_prot() to fire even though this is a valid user mapping. Execute-only mappings have the same issue and must not be readable through this path either.
ioremap_prot() should therefore reject protection values without PTE_USER without warning. This makes the access fail cleanly for PROT_NONE and execute-only mappings while retaining the existing user-protection contract.
Which versions are affected by CVE-2026-98923?
How do I fix CVE-2026-98923?
Upgrade to a fixed version.
Is CVE-2026-98923 being exploited?
There is no known exploitation of CVE-2026-98923 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98923, DEBIAN-CVE-2026-98923, GHSA-q3vh-mmhj-mxhr, UBUNTU-CVE-2026-98923.