CVE-2026-89793

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ublk: clear VM_MAYWRITE on read-only ublk char device mmap

ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never

clears VM_MAYWRITE on the resulting read-only mapping. This allows

a userspace daemon to mmap the per-queue command buffer PROT_READ,

then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was

never cleared.

The command buffer holds struct ublksrv_io_desc entries that are

kernel-written ABI; a writable mapping lets an unprivileged daemon

process corrupt fields such as addr, op_flags, nr_sectors, and

start_sector.

Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and

the 2026-08-13 ptp/vmclock fix (a5edadbae57e).

Verified via mprotect() PoC: before the fix, a PROT_READ mapping can

be upgraded to PROT_READ|PROT_WRITE and a write into the command

buffer corrupts io_desc fields (confirmed under KASAN). After the

fix, mprotect() returns -EACCES.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References