What is CVE-2026-89793?

CVE-2026-89793 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, affecting Linux kernel versions from 6.0 onward and patched in 6.6.157, 6.12.110, 6.18.51 and others. CVE-2026-89793 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-89793?

CVE-2026-89793 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2026-89793?

Yes, CVE-2026-89793 has been patched. Fixed versions include 6.6.157, 6.12.110, 6.18.51 and others. If you are running Linux kernel 6.0 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-89793 actively exploited?

CVE-2026-89793 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-89793

High

In the Linux kernel, the following vulnerability has been resolved: ublk: clear VM_MAYWRITE on read-only ublk char device mmap ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never clears VM_MAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROT_READ, then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was never cleared. The command buffer holds struct ublksrv_io_desc entries that are kernel-written ABI; a writable mapping lets an unprivileged daemon process corrupt fields such as addr, op_flags, nr_sectors, and start_sector. Same bug class as the drm/panthor and drm/vc4 VM_MAYWRITE fixes, and the 2026-08-13 ptp/vmclock fix (a5edadbae57e). Verified via mprotect() PoC: before the fix, a PROT_READ mapping can be upgraded to PROT_READ|PROT_WRITE and a write into the command buffer corrupts io_desc fields (confirmed under KASAN). After the fix, mprotect() returns -EACCES.

Package Linux Kernel

Published 2026-09-16

Last modified 2026-10-05

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Linux kernel versions 6.0 and later are affected. Fixed in 6.6.157, 6.12.110, 6.18.51, 7.2.5, 7.3-rc2 and their respective stable series.

Affected from

≥ 6.0

Fixed in

✓ 6.6.157 6.6.x ✓ 6.12.110 6.12.x ✓ 6.18.51 6.18.x ✓ 7.2.5 7.2.x ✓ 7.3-rc2

References

5 total

Details

CVE ID CVE-2026-89793

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2026-09-16

Modified 2026-10-05

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-89793?

CVE-2026-89793 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 . It affects Linux kernel versions from 6.0 onward and has been patched in 6.6.157, 6.12.110, 6.18.51 and others. CVE-2026-89793 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-89793?

CVE-2026-89793 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2026-89793?

Yes. CVE-2026-89793 has been patched. Fixed versions include 6.6.157, 6.12.110, 6.18.51 and others. If you are running Linux kernel 6.0 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-89793 actively exploited?

No. CVE-2026-89793 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.