CVE-2026-89745 debugfs: Fix lockdown check for mmap_prepare
Attackers with high privileges can bypass kernel lockdown integrity checks on debugfs files using mmap_prepare, potentially compromising system integrity.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89745?
CVE-2026-89745 is a vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
debugfs: Fix lockdown check for mmap_prepare
Commit 651fdda8406d ("relay: update relay to use mmap_prepare") changed the `mmap` file operation to `mmap_prepare` for relayfs, but the lockdown check in debugfs was not updated accordingly.
This prevents debugfs from being locked down when the kernel is in integrity mode if a file uses `mmap_prepare` but not `mmap`.
Since the conversion to `mmap_prepare` across the kernel is not yet complete, update the lockdown check to look for both `mmap` and `mmap_prepare` to ensure comprehensive coverage.
Which versions are affected by CVE-2026-89745?
How do I fix CVE-2026-89745?
Apply the vendor's patch.
Is CVE-2026-89745 being exploited?
There is no known exploitation of CVE-2026-89745 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-89745, GHSA-93g4-3jvg-hjgx, UBUNTU-CVE-2026-89745.