CVE-2026-89793: ublk: clear VM_MAYWRITE on read-only ublk char device mmap
In the Linux kernel, the following vulnerability has been resolved:
ublk: clear VMMAYWRITE on read-only ublk char device mmap
ublkchmmap() rejects mmap requests with VMWRITE set, but never clears VMMAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROTREAD, then upgrade it to PROTWRITE via mprotect(), since VMMAYWRITE was never cleared.
The command buffer holds struct ublksrviodesc entries that are kernel-written ABI; a writable mapping lets an unprivileged daemon process corrupt fields such as addr, opflags, nrsectors, and startsector.
Same bug class as the drm/panthor and drm/vc4 VMMAYWRITE fixes, and the 2026-08-13 ptp/vmclock fix (a5edadbae57e).
Verified via mprotect() PoC: before the fix, a PROTREAD mapping can be upgraded to PROTREAD|PROTWRITE and a write into the command buffer corrupts iodesc fields (confirmed under KASAN). After the fix, mprotect() returns -EACCES.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 2026-08-13 ptp/vmclock fix (a5edadbae57e).
Event History
Frequently Asked Questions
Who can exploit this issue?
An unprivileged userspace daemon that can mmap a ublk per-queue command buffer is the relevant attacker. The daemon can alter kernel-written ublk I/O descriptor fields after changing a read-only mapping to writable.
What is required to trigger the vulnerability?
The attacker must create a PROT_READ mapping of the ublk character-device command buffer, then use mprotect() to request PROT_READ|PROT_WRITE. Before the fix, this succeeds because VM_MAYWRITE remains set on the mapping.
How can I determine whether the fix is present?
Attempting to upgrade the read-only command-buffer mapping with mprotect() should fail with -EACCES after the fix. Before the fix, the protection change can succeed and writes can corrupt ublksrv_io_desc fields.