CVE-2026-89745: debugfs: Fix lockdown check for mmap_prepare
In the Linux kernel, the following vulnerability has been resolved:
debugfs: Fix lockdown check for mmapprepare
Commit 651fdda8406d ("relay: update relay to use mmapprepare") changed the mmap file operation to mmapprepare for relayfs, but the lockdown check in debugfs was not updated accordingly.
This prevents debugfs from being locked down when the kernel is in integrity mode if a file uses mmapprepare but not mmap.
Since the conversion to mmapprepare across the kernel is not yet complete, update the lockdown check to look for both mmap and mmapprepare to ensure comprehensive coverage.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using debugfs while the kernel is in integrity lockdown mode are affected when a debugfs file uses mmap_prepare but does not use mmap. The issue is relevant because the prior check did not recognize mmap_prepare as requiring lockdown handling.
What conditions are required to trigger the missing lockdown protection?
The kernel must be operating in integrity mode, and a debugfs file must implement mmap_prepare without mmap. The incomplete conversion of kernel users from mmap to mmap_prepare makes checking both operations necessary.
How can I determine whether the fix is present?
Verify that the kernel's debugfs lockdown check examines both mmap and mmap_prepare file operations. The provided stable kernel references contain the remediation.