UBUNTU-CVE-2026-89793: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ublk: clear VMMAYWRITE on read-only ublk char device mmap ublkchmmap() rejects mmap requests with VMWRITE set, but never clears VMMAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROTREAD, then upgrade it to PROTWRITE via mprotect(), since VMMAYWRITE was never cleared. The command buffer holds struct ublksrviodesc entries that are kernel-written ABI; a writable mapping lets an unprivileged daemon process corrupt fields such as addr, opflags, nrsectors, and startsector. Same bug class as the drm/panthor and drm/vc4 VMMAYWRITE fixes, and the 2026-08-13 ptp/vmclock fix (a5edadbae57e). Verified via mprotect() PoC: before the fix, a PROTREAD mapping can be upgraded to PROTREAD|PROTWRITE and a write into the command buffer corrupts iodesc fields (confirmed under KASAN). After the fix, mprotect() returns -EACCES.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What level of access does an attacker need?
Exploitation requires local access with low privileges and access to a userspace daemon that can map the ublk per-queue command buffer. No user interaction is required.
Which Ubuntu kernel package families are identified as affected?
The affected software list includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
How can I tell whether the fix is present?
On a fixed kernel, attempting to change a read-only mapping of the ublk command buffer to PROT_READ|PROT_WRITE with mprotect() returns -EACCES. Before the fix, that protection change succeeds and permits writes to command-buffer io_desc fields.