CVE-2026-89793
Received Received - Intake

Memory Corruption in Linux Kernel via ublk mmap

Publication date: 2026-09-16

Last updated on: 2026-09-16

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ublk: clear VM_MAYWRITE on read-only ublk char device mmap ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never clears VM_MAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROT_READ, then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was never cleared. The command buffer holds struct ublksrv_io_desc entries that are kernel-written ABI; a writable mapping lets an unprivileged daemon process corrupt fields such as addr, op_flags, nr_sectors, and start_sector. Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and the 2026-08-13 ptp/vmclock fix (a5edadbae57e). Verified via mprotect() PoC: before the fix, a PROT_READ mapping can be upgraded to PROT_READ|PROT_WRITE and a write into the command buffer corrupts io_desc fields (confirmed under KASAN). After the fix, mprotect() returns -EACCES.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-16
Last Modified
2026-09-16
Generated
2026-09-16
AI Q&A
2026-09-16
EPSS Evaluated
N/A
NVD
CVE-2026-89793
EUVD
EUVD-2026-80589

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ublk driver where a read-only memory mapping can be incorrectly upgraded to a writable state. The issue occurs because the VM_MAYWRITE flag is not cleared when a userspace daemon maps the device's command buffer as read-only. This allows the daemon to use mprotect() to change the mapping to writable, enabling it to corrupt kernel-written data in the buffer.

Detection Guidance

This vulnerability is specific to the Linux kernel's ublk driver and requires kernel-level inspection. Check if your kernel version includes the fix by running uname -r and comparing against patched versions. Look for unusual behavior in ublk-related processes or command buffer corruption. No direct network detection commands are applicable.

Impact Analysis

If exploited, this vulnerability could allow an unprivileged userspace process to corrupt critical fields in the kernel's command buffer, such as memory addresses, operation flags, and sector data. This could lead to system instability, crashes, or potential privilege escalation if the corrupted data affects kernel operations.

Mitigation Strategies

Apply the latest kernel security updates immediately. If updating is not possible, disable the ublk module by running modprobe -r ublk or blacklisting it. Restrict access to ublk device files in /dev. Monitor for suspicious mprotect() calls or command buffer modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89793. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart