Skip to main content

Linux Kernel EUVDEUVD-2026-80589

| CVE-2026-89793 HIGH
2026-09-16 Linux GHSA-fp98-h54j-vwfj
Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local-only (AV:L) attacker running as the low-privileged ublk daemon (PR:L) reliably corrupts kernel-written descriptors (AC:L), yielding kernel memory corruption with high C/I/A.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 16, 2026 - 15:40 vuln.today
tag: Information Disclosure removed
Analysis Generated
Sep 16, 2026 - 15:26 vuln.today
CVSS changed
Sep 16, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Sep 16, 2026 - 11:03 EUVD
CVE Published
Sep 16, 2026 - 09:54 cve.org
HIGH 7.8
CVE Published
Sep 16, 2026 - 09:54 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ublk: clear VM_MAYWRITE on read-only ublk char device mmap

ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never clears VM_MAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROT_READ, then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was never cleared.

The command buffer holds struct ublksrv_io_desc entries that are kernel-written ABI; a writable mapping lets an unprivileged daemon process corrupt fields such as addr, op_flags, nr_sectors, and start_sector.

Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and the 2026-08-13 ptp/vmclock fix (a5edadbae57e).

Verified via mprotect() PoC: before the fix, a PROT_READ mapping can be upgraded to PROT_READ|PROT_WRITE and a write into the command buffer corrupts io_desc fields (confirmed under KASAN). After the fix, mprotect() returns -EACCES.

AnalysisAI

Missing VM_MAYWRITE clearing in the Linux kernel's ublk (userspace block driver) character-device mmap path allows the local ublk server daemon to take a read-only mapping of the per-queue command buffer and upgrade it to writable with mprotect(), giving it write access to kernel-owned ABI data. Because the command buffer holds struct ublksrv_io_desc entries (addr, op_flags, nr_sectors, start_sector) that the kernel populates and consumes, an attacker controlling a ublk device instance can corrupt those fields from an unprivileged process, yielding high confidentiality and integrity impact with a local CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires the ublk (userspace block driver) subsystem to be built and loaded (CONFIG_BLK_DEV_UBLK) and the attacker to be running as the userspace ublk server daemon that legitimately opens the ublk char device and mmaps the per-queue command buffer. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine local privilege-context memory-corruption bug, but not a broad-reach priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the vendor-released kernel patch: CVE-2026-89793 is fixed in Linux 6.6.157, 6.12.110, 6.18.51, 7.2.5 and 7.3-rc2 (per-branch commits are listed at https://git.kernel.org/stable/c/be41733c24be58e2a1ef718c80fafdfb98a40d5e, https://git.kernel.org/stable/c/5befd06a72216869b607cf7724a4f16c6a2d3999, https://git.kernel.org/stable/c/e373c1acdbcf88cec533ece9f589020adaed0a78, https://git.kernel.org/stable/c/fa5e1bc673ca59722608af67b27e65dba0c97926 and https://git.kernel.org/stable/c/6e2b571b0a54755b06e092501913e1dfefe75d6c; see also the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-89793). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, confirm whether the ublk subsystem is built and in active use across the Linux estate, inventory affected kernel versions against the vendor advisory, and treat kernels with ublk enabled as the priority remediation population; where the subsystem is not operationally required, disable or do not load the ublk modules as an immediate stopgap. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

EUVD-2026-80589 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy