HIGH Introduced in 6.0
ublk CmdBuf Bypass
CVE-2026-89793
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ublk: clear VM_MAYWRITE on read-only ublk char device mmap ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never clears VM_MAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROT_READ, then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was never cleared. The command buffer holds struct ublksrv_io_desc entries that are kernel-written ABI; a writable mapping lets an unprivileged daemon process corrupt fields such as addr, op_flags, nr_sectors, and start_sector. Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and the 2026-08-13 ptp/vmclock fix (a5edadbae57e). Verified via mprotect() PoC: before the fix, a PROT_READ mapping can be upgraded to PROT_READ|PROT_WRITE and a write into the command buffer corrupts io_desc fields (confirmed under KASAN). After the fix, mprotect() returns -EACCES.
02KernelScan AI Analysis
Risk summary
A local process with access to a ublk character device file descriptor can bypass the read-only protection on the per-queue command buffer by upgrading the mapping to writable via mprotect(). This allows corruption of kernel-trusted I/O descriptor fields, potentially leading to arbitrary kernel memory access or a system crash. Any deployment that runs a ublk daemon — especially with untrusted or containerized workloads — is at risk.
Vulnerability analysis
The ublk driver maps a per-queue command buffer to userspace as read-only, but the mmap handler only rejects the initial write permission flag without clearing the flag that permits a later upgrade via mprotect(). A daemon process can therefore mmap the buffer read-only, then call mprotect to make it writable, and overwrite kernel-written I/O descriptor fields that the kernel trusts on subsequent I/O operations. The fix clears the may-write flag so mprotect can never add write permissions to the mapping. A local process holding the ublk character device file descriptor can trigger this; the device is typically created by a privileged setup operation, but the per-queue descriptor can be passed to an unprivileged daemon, making the bug reachable without root privileges at trigger time.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.6 | 6.0 | 6.6.157 | be41733c24be |
| 6.12 | 6.0 | 6.12.110 | 5befd06a7221 |
| 6.18 | 6.0 | 6.18.51 | e373c1acdbcf |
| 7.2 | 6.0 | 7.2.5 | fa5e1bc673ca |
| mainline | 6.0 | 7.3-rc2 | 6e2b571b0a54 |
| cip/6.12 | 6.0 | 6.12.111-cip32 | 5befd06a7221 |