CVE-2026-89793

A flaw was found in the Linux kernel's ublk subsystem. An unprivileged userspace daemon can exploit this by mapping a read-only ublk character device's command buffer, then elevating its permissions to write access. This allows the daemon to corrupt critical kernel-written data within the command buffer, potentially leading to system instability or unauthorized operations.

A protection flaw in ublk_ch_mmap leaves VM_MAYWRITE set on a command buffer that is intended to be mapped read only. A local ublk daemon can map the buffer with PROT_READ and then use mprotect to upgrade the mapping to PROT_WRITE, gaining a constrained write primitive over kernel-written ublksrv_io_desc entries. The attacker can modify fields such as addr, op_flags, nr_sectors, and start_sector while the buffer participates in block I/O processing. This can corrupt request semantics, disrupt the affected ublk device, damage data, or cause a denial of service. A direct arbitrary kernel write or reliable privilege escalation is not established, but the writable kernel-allocated ABI buffer creates a plausible memory corruption boundary that requires review of all later kernel consumers. For the CVSS the PR:L is selected because triggering requires a local process with access to the affected ublk character device, but it does not necessarily require full root privileges. The issue is not directly network reachable. The paranoid score uses CIA:HHH because controlled corruption of kernel-owned I/O descriptors may have broader confidentiality, integrity, and availability consequences if any later kernel path trusts the modified fields.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.