The flaw resides in the Linux kernel’s arm64 ioremap_prot() routine, which incorrectly accepts non‑user protection values such as PROT_NONE or execute‑only mappings. When a process maps a stack‑top page via /dev/mem with PROT_NONE and subsequently reads its own /proc/<pid>/cmdline, a WARN_ON_ONCE is triggered. The warning is emitted because pte_present() mistakenly reports a present‑invalid PTE as a user mapping, causing ioremap_prot() to raise a warning instead of rejecting the mapping gracefully. This results in spurious kernel log messages but does not lead to information disclosure or arbitrary code execution.

Affected systems are ARM64 Linux systems that use the kernel version containing the unpatched ioremap_prot() implementation. No specific release or version is listed, so any arm64 kernel prior to the patch is potentially vulnerable.

The CVSS score of 5.5 and an EPSS score of < 1% indicate a moderate to low risk of exploitation. The likely attack vector is privileged memory mapping via /dev/mem, which typically requires root or CAP_SYS_RAWIO. Since the vulnerability only produces kernel warnings, repeated triggering could clutter logs or be used to obscure other activities, but does not grant direct control or data exfiltration. The issue is not listed in the CISA KEV catalog, further suggesting low real‑world exploitation activity.