Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-89793— ublk: clear VM_MAYWRITE on read-only ublk char device mmap

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

In the Linux kernel, the following vulnerability has been resolved: ublk: clear VM_MAYWRITE on read-only ublk char device mmap ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never clears VM_MAYWRITE on the resulting read-only mapping. This allows

AI Predicted 7.8 Difficulty: Moderate
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89793

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ublk: clear VM_MAYWRITE on read-only ublk char device mmap
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ublk: clear VM_MAYWRITE on read-only ublk char device mmap ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never clears VM_MAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROT_READ, then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was never cleared. The command buffer holds struct ublksrv_io_desc entries that are kernel-written ABI; a writable mapping lets an unprivileged daemon process corrupt fields such as addr, op_flags, nr_sectors, and start_sector. Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and the 2026-08-13 ptp/vmclock fix (a5edadbae57e). Verified via mprotect() PoC: before the fix, a PROT_READ mapping can be upgraded to PROT_READ|PROT_WRITE and a write into the command buffer corrupts io_desc fields (confirmed under KASAN). After the fix, mprotect() returns -EACCES.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ be41733c24be58e2a1ef718c80fafdfb98a40d5e -
Linux Linux 6.6.157 ~ 6.6.* -

II. Public POCs for CVE-2026-89793

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89793

请登录查看更多情报信息。

Other References for CVE-2026-89793 (5)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-89860 scsi: qla2xxx: Initialize NVMe abort_work once at submission
CVE-2026-89877 media: saa7164: fix cleanup on resource allocation failure
CVE-2026-89875 media: ti: vpe: quiesce overflow recovery before freeing streams
CVE-2026-89876 media: tda18250: fix possible integer overflow
CVE-2026-89874 media: v4l2-async: avoid deleting unlinked ASC entry on link error
CVE-2026-89872 media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
CVE-2026-89873 media: v4l2-ctrls: validate HEVC EXT SPS RPS counts
CVE-2026-89871 media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
CVE-2026-89870 media: zoran: Avoid freeing a registered video_device twice
CVE-2026-89869 media: qcom: iris: use disable_irq() during power-off
CVE-2026-89868 media: chips-media: wave5: Add timeout while stop_streaming
CVE-2026-89867 media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued
CVE-2026-89866 media: chips-media: wave5: Resume device before setting EOS flag
CVE-2026-89865 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
CVE-2026-89864 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
CVE-2026-89863 scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
CVE-2026-89862 scsi: qla2xxx: Fix BSG job leak on validate flash image error path
CVE-2026-89861 scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
CVE-2026-89850 scsi: qla2xxx: Don't query firmware state while chip is down
CVE-2026-89848 scsi: qla2xxx: Quiesce response IRQ before freeing request queue

Showing top 20 of 276 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89793

No comments yet

Leave a comment