Cloudanix VulnDB

CVE-2026-89745

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A missing check in the Linux kernel's debug interface could let certain memory-mapping actions slip past the lockdown protections that are supposed to keep the system secure.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The debugfs lockdown check only inspected the legacy mmap file operation and ignored the newer mmap_prepare operation used by relayfs and other subsystems, allowing mmap access to proceed when the kernel is in integrity lockdown mode.

Why it matters to the business

Systems configured for kernel lockdown integrity mode may still permit unauthorized memory mapping through debugfs, weakening the intended hardware and firmware protection boundary and increasing exposure on production Linux hosts.

How an attack unfolds

An attacker with local access opens a relayfs or similar debugfs file that registers only mmap_prepare, triggers mmap while the kernel is in integrity lockdown, and bypasses the lockdown check because the updated operation was never examined.

How to fix it

Apply the upstream commit that updates the debugfs lockdown check to test for both mmap and mmap_prepare operations; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

After patching, confirm the lockdown check source inspects both file operations; test by attempting mmap on a relay-backed debugfs file while in integrity lockdown and verify the operation is denied.

Typical attack path

  1. Obtain local unprivileged access on a Linux system with kernel lockdown enabled in integrity mode.
  2. Locate a debugfs file backed by relay or another mmap_prepare user.
  3. Call mmap on the file descriptor.
  4. Bypass the incomplete lockdown enforcement and obtain a writable mapping.
  5. Use the mapping to alter protected kernel or firmware structures.

How to detect it

Review kernel source for the debugfs lockdown predicate both before and after the fix; examine audit logs for unexpected successful mmap syscalls on debugfs inodes while lockdown is active.

What your security team should do

  • Prioritize patching all production kernels that enable lockdown=integrity.
  • Audit custom or third-party modules that register debugfs files with mmap_prepare.
  • Add kernel lockdown status to baseline configuration checks and monitoring.

The record

In the Linux kernel, the following vulnerability has been resolved: debugfs: Fix lockdown check for mmap_prepare Commit 651fdda8406d ("relay: update relay to use mmap_prepare") changed the `mmap` file operation to `mmap_prepare` for relayfs, but the lockdown check in debugfs was not updated accordingly. This prevents debugfs from being locked down when the kernel is in integrity mode if a file uses `mmap_prepare` but not `mmap`. Since the conversion to `mmap_prepare` across the kernel is not yet complete, update the lockdown check to look for both `mmap` and `mmap_prepare` to ensure comprehensive coverage.

Affected packages

Ecosystem Package Introduced Fixed