{"id":"CVE-2026-89793","revision":"9ab552731a88427693bf5cd4040dec8e","records":[{"revision":"9ab552731a88427693bf5cd4040dec8e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89793","aliases":[],"title":"ublk: clear VM_MAYWRITE on read-only ublk char device mmap","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nublk: clear VM_MAYWRITE on read-only ublk char device mmap\n\nublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never\nclears VM_MAYWRITE on the resulting read-only mapping. This allows\na userspace daemon to mmap the per-queue command buffer PROT_READ,\nthen upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was\nnever cleared.\n\nThe command buffer holds struct ublksrv_io_desc entries that are\nkernel-written ABI; a writable mapping lets an unprivileged daemon\nprocess corrupt fields such as addr, op_flags, nr_sectors, and\nstart_sector.\n\nSame bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and\nthe 2026-08-13 ptp/vmclock fix (a5edadbae57e).\n\nVerified via mprotect() PoC: before the fix, a PROT_READ mapping can\nbe upgraded to PROT_READ|PROT_WRITE and a write into the command\nbuffer corrupts io_desc fields (confirmed under KASAN). After the\nfix, mprotect() returns -EACCES.","state":0,"publishedAt":"2026-09-16T09:54:33.678+00:00","modifiedAt":"2026-10-19T08:52:48.148+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/block/ublk_drv.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"71f28f3136aff5890cd56de78abc673f8393cad9\",\n                            \"lessThan\": \"be41733c24be58e2a1ef718c80fafdfb98a40d5e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"71f28f3136aff5890cd56de78abc673f8393cad9\",\n                            \"lessThan\": \"5befd06a72216869b607cf7724a4f16c6a2d3999\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"71f28f3136aff5890cd56de78abc673f8393cad9\",\n                            \"lessThan\": \"e373c1acdbcf88cec533ece9f589020adaed0a78\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"71f28f3136aff5890cd56de78abc673f8393cad9\",\n                            \"lessThan\": \"fa5e1bc673ca59722608af67b27e65dba0c97926\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"71f28f3136aff5890cd56de78abc673f8393cad9\",\n                            \"lessThan\": \"6e2b571b0a54755b06e092501913e1dfefe75d6c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/block/ublk_drv.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/be41733c24be58e2a1ef718c80fafdfb98a40d5e","https://git.kernel.org/stable/c/5befd06a72216869b607cf7724a4f16c6a2d3999","https://git.kernel.org/stable/c/e373c1acdbcf88cec533ece9f589020adaed0a78","https://git.kernel.org/stable/c/fa5e1bc673ca59722608af67b27e65dba0c97926","https://git.kernel.org/stable/c/6e2b571b0a54755b06e092501913e1dfefe75d6c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89793","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89793","identifiers":["CVE-2026-89793"]},"retained":false,"historicalAffected":[]}],"coverage":[]}