UBUNTU-CVE-2026-98923: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremapprot() Mapping a stack-top page via /dev/mem with PROTNONE and then reading that process's /proc/<pid>/cmdline triggers a spurious WARN in ioremapprot() through genericaccessphys(): WARNING: ./arch/arm64/include/asm/io.h:275 at genericaccessphys Call trace: genericaccessphys+0x1c8/0x228 (P) accessremotevm+0x2b4/0x398 accessremotevm+0x14/0x30 getmmcmdline+0xf8/0x2a0 procpidcmdlineread+0x68/0x120 genericaccessphys() passes the protection derived from the user PTE to ioremapprot(). On arm64, a PROTNONE mapping is represented by a present-invalid PTE, so ptepresent() still returns true and the protection reaches ioremapprot(). A PROTNONE mapping does not have PTEUSER, causing the existing WARNONONCE() in ioremapprot() to fire even though this is a valid user mapping. Execute-only mappings have the same issue and must not be readable through this path either. ioremapprot() should therefore reject protection values without PTEUSER without warning. This makes the access fail cleanly for PROTNONE and execute-only mappings while retaining the existing user-protection contract.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to the reported warning condition?
The issue applies to the listed Ubuntu kernel packages on arm64 systems when a process has a PROT_NONE or execute-only user mapping and that memory is accessed through the affected remote-memory path, such as reading /proc/<pid>/cmdline. The provided data does not identify affected package versions.
What does an attacker or local user need to do to trigger it?
A local process must create a PROT_NONE or execute-only mapping, such as mapping a stack-top page via /dev/mem with PROT_NONE. A read of that process's /proc/<pid>/cmdline can then reach generic_access_phys() and trigger the spurious warning.
What is the behavior after the fix?
The fix makes ioremap_prot() reject protection values that lack PTE_USER without issuing a warning. Access to PROT_NONE and execute-only mappings through this path fails cleanly, and execute-only mappings remain unreadable.