CVE-2026-89793 is a vulnerability in Linux Kernel
Published on September 16, 2026
ublk: clear VM_MAYWRITE on read-only ublk char device mmap
In the Linux kernel, the following vulnerability has been resolved:
ublk: clear VM_MAYWRITE on read-only ublk char device mmap
ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never
clears VM_MAYWRITE on the resulting read-only mapping. This allows
a userspace daemon to mmap the per-queue command buffer PROT_READ,
then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was
never cleared.
The command buffer holds struct ublksrv_io_desc entries that are
kernel-written ABI; a writable mapping lets an unprivileged daemon
process corrupt fields such as addr, op_flags, nr_sectors, and
start_sector.
Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and
the 2026-08-13 ptp/vmclock fix (a5edadbae57e).
Verified via mprotect() PoC: before the fix, a PROT_READ mapping can
be upgraded to PROT_READ|PROT_WRITE and a write into the command
buffer corrupts io_desc fields (confirmed under KASAN). After the
fix, mprotect() returns -EACCES.
Products Associated with CVE-2026-89793
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below be41733c24be58e2a1ef718c80fafdfb98a40d5e is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 5befd06a72216869b607cf7724a4f16c6a2d3999 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below e373c1acdbcf88cec533ece9f589020adaed0a78 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below fa5e1bc673ca59722608af67b27e65dba0c97926 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 6e2b571b0a54755b06e092501913e1dfefe75d6c is affected.
- Before 6.6.157 is affected.
- Before 6.12.110 is affected.
- Before 6.18.51 is affected.
- Before 7.2.5 is affected.
- Version 6.6.157, <= 6.6.* is unaffected.
- Version 6.12.110, <= 6.12.* is unaffected.
- Version 6.18.51, <= 6.18.* is unaffected.
- Version 7.2.5, <= 7.2.* is unaffected.
- Version 7.3-rc2, <= * is unaffected.