---
cve: "CVE-2026-89793"
severity: "HIGH"
cvss: 7.8
epss: "0.2%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-09-16 09:54:33"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-21T08:56:54+02:00"
---

# CVE-2026-89793

> 7.8 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

ublk: clear VM_MAYWRITE on read-only ublk char device mmap

ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never
clears VM_MAYWRITE on the resulting read-only mapping. This allows
a userspace daemon to mmap the per-queue command buffer PROT_READ,
then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was
never cleared.

The command buffer holds struct ublksrv_io_desc entries that are
kernel-written ABI; a writable mapping lets an unprivileged daemon
process corrupt fields such as addr, op_flags, nr_sectors, and
start_sector.

Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and
the 2026-08-13 ptp/vmclock fix (a5edadbae57e).

Verified via mprotect() PoC: before the fix, a PROT_READ mapping can
be upgraded to PROT_READ|PROT_WRITE and a write into the command
buffer corrupts io_desc fields (confirmed under KASAN). After the
fix, mprotect() returns -EACCES.

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- Kernel ≥ 6.6.157
- Kernel ≥ 6.12.110
- Kernel ≥ 6.18.51
- Kernel ≥ 7.2.5

## Referenzen

- <https://git.kernel.org/stable/c/be41733c24be58e2a1ef718c80fafdfb98a40d5e>
- <https://git.kernel.org/stable/c/5befd06a72216869b607cf7724a4f16c6a2d3999>
- <https://git.kernel.org/stable/c/e373c1acdbcf88cec533ece9f589020adaed0a78>
- <https://git.kernel.org/stable/c/fa5e1bc673ca59722608af67b27e65dba0c97926>
- <https://git.kernel.org/stable/c/6e2b571b0a54755b06e092501913e1dfefe75d6c>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-89793) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_