EUVD-2026-80589
GHSA-fp98-h54j-vwfj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only (AV:L) attacker running as the low-privileged ublk daemon (PR:L) reliably corrupts kernel-written descriptors (AC:L), yielding kernel memory corruption with high C/I/A.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ublk: clear VM_MAYWRITE on read-only ublk char device mmap
ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never clears VM_MAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROT_READ, then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was never cleared.
The command buffer holds struct ublksrv_io_desc entries that are kernel-written ABI; a writable mapping lets an unprivileged daemon process corrupt fields such as addr, op_flags, nr_sectors, and start_sector.
Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and the 2026-08-13 ptp/vmclock fix (a5edadbae57e).
Verified via mprotect() PoC: before the fix, a PROT_READ mapping can be upgraded to PROT_READ|PROT_WRITE and a write into the command buffer corrupts io_desc fields (confirmed under KASAN). After the fix, mprotect() returns -EACCES.
AnalysisAI
Missing VM_MAYWRITE clearing in the Linux kernel's ublk (userspace block driver) character-device mmap path allows the local ublk server daemon to take a read-only mapping of the per-queue command buffer and upgrade it to writable with mprotect(), giving it write access to kernel-owned ABI data. Because the command buffer holds struct ublksrv_io_desc entries (addr, op_flags, nr_sectors, start_sector) that the kernel populates and consumes, an attacker controlling a ublk device instance can corrupt those fields from an unprivileged process, yielding high confidentiality and integrity impact with a local CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ublk (userspace block driver) subsystem to be built and loaded (CONFIG_BLK_DEV_UBLK) and the attacker to be running as the userspace ublk server daemon that legitimately opens the ublk char device and mmaps the per-queue command buffer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine local privilege-context memory-corruption bug, but not a broad-reach priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released kernel patch: CVE-2026-89793 is fixed in Linux 6.6.157, 6.12.110, 6.18.51, 7.2.5 and 7.3-rc2 (per-branch commits are listed at https://git.kernel.org/stable/c/be41733c24be58e2a1ef718c80fafdfb98a40d5e, https://git.kernel.org/stable/c/5befd06a72216869b607cf7724a4f16c6a2d3999, https://git.kernel.org/stable/c/e373c1acdbcf88cec533ece9f589020adaed0a78, https://git.kernel.org/stable/c/fa5e1bc673ca59722608af67b27e65dba0c97926 and https://git.kernel.org/stable/c/6e2b571b0a54755b06e092501913e1dfefe75d6c; see also the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-89793). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether the ublk subsystem is built and in active use across the Linux estate, inventory affected kernel versions against the vendor advisory, and treat kernels with ublk enabled as the priority remediation population; where the subsystem is not operationally required, disable or do not load the ublk modules as an immediate stopgap. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today