CVE-2026-89793: ublk: clear VM_MAYWRITE on read-only ublk char device mmap
In the Linux kernel, the following vulnerability has been resolved:
ublk: clear VMMAYWRITE on read-only ublk char device mmap
ublkchmmap() rejects mmap requests with VMWRITE set, but never clears VMMAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROTREAD, then upgrade it to PROTWRITE via mprotect(), since VMMAYWRITE was never cleared.
The command buffer holds struct ublksrviodesc entries that are kernel-written ABI; a writable mapping lets an unprivileged daemon process corrupt fields such as addr, opflags, nrsectors, and startsector.
Same bug class as the drm/panthor and drm/vc4 VMMAYWRITE fixes, and the 2026-08-13 ptp/vmclock fix (a5edadbae57e).
Verified via mprotect() PoC: before the fix, a PROTREAD mapping can be upgraded to PROTREAD|PROTWRITE and a write into the command buffer corrupts iodesc fields (confirmed under KASAN). After the fix, mprotect() returns -EACCES.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Clear VM_MAYWRITE on read-only ublk character-device mmap mappings so that mprotect() returns -EACCES when attempting to add PROT_WRITE.
ublk_ch_mmap() VM_MAYWRITE = cleared
Event History
Frequently Asked Questions
Who can exploit this issue?
An unprivileged userspace daemon that can mmap a ublk per-queue command buffer is the relevant attacker. The daemon can alter kernel-written ublk I/O descriptor fields after changing a read-only mapping to writable.
What is required to trigger the vulnerability?
The attacker must create a PROT_READ mapping of the ublk character-device command buffer, then use mprotect() to request PROT_READ|PROT_WRITE. Before the fix, this succeeds because VM_MAYWRITE remains set on the mapping.
How can I determine whether the fix is present?
Attempting to upgrade the read-only command-buffer mapping with mprotect() should fail with -EACCES after the fix. Before the fix, the protection change can succeed and writes can corrupt ublksrv_io_desc fields.