In the Linux kernel, a flaw in the ublk subsystem allows an unprivileged user to map the per‑queue command buffer with read permissions and then upgrade that mapping to write using mprotect. Because the VM_MAYWRITE flag is not cleared on the resulting read‑only mapping, the kernel erroneously permits the user to modify kernel‑written structures that describe I/O descriptors. Corrupting these fields can compromise kernel integrity and potentially allow the attacker to execute malicious code or gain higher privileges. This flaw effectively provides unauthorized write access to critical kernel data.

All Linux kernels that include the ublk char device feature and have not yet incorporated the patch that clears the VM_MAYWRITE flag. The specific vulnerable versions are all releases prior to the committing changes in the kernel source code referenced by the advisory. The flaw affects the core Linux kernel and is disclosed for all distributions running those kernels.

The CVSS score of 7.8 labels this vulnerability as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the near term, and it is not presently listed in the CISA KEV catalog. The workaround in the kernel requires a local, unprivileged user with access to a ublk device; the attacker can acquire such a user simply by running a daemon that interacts with the device. Once the mmap is upgraded to write, kernel memory corruption can occur, which is a strong indicator of privilege escalation potential. Attackers could therefore look to exploit this locals vulnerability to transition from user space to kernel space, but due to the low EPSS score and lack of widespread known exploits, the likelihood of immediate exploitation is limited.