In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremap_prot() Mapping a stack-top page… (CVE-2026-98923)

The Linux kernel arm64 io subsystem had a vulnerability where ioremap_prot() did not properly reject non-user protection flags in memory mappings. Specifically, mapping a stack-top page via /dev/mem with PROT_NONE and then reading /proc/<pid>/cmdline triggered a spurious WARN in ioremap_prot() through generic_access_phys(). This occurred because PROT_NONE mappings are represented by present-invalid PTEs, causing pte_present() to return true and the protection to reach ioremap_prot() without PTE_USER. The existing WARN_ON_ONCE() fired incorrectly despite the mapping being valid. The fix modifies ioremap_prot() to reject protection values lacking PTE_USER without warning, causing access to fail cleanly for PROT_NONE and execute-only mappings while preserving the user-protection contract.

The vulnerability caused spurious kernel warnings when accessing certain memory mappings, which could lead to confusion or misdiagnosis during debugging or system monitoring. There is no indication of direct security compromise or exploitation. The fix prevents these warnings and ensures proper handling of memory protections in the arm64 kernel io subsystem.

A fix has been implemented in the Linux kernel to reject protection values without PTE_USER in ioremap_prot(), eliminating the spurious warnings and properly handling PROT_NONE and execute-only mappings. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.