CVE-2026-89723
Received Received - Intake

nilfs2 slab-out-of-bounds in Linux kernel

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfs_direct_propagate() during testing. Analysis revealed that after truncating a file, a node block immediately below the B-tree root was not deleted. Instead, it remained in the B-tree node cache in a dirty state. The log writer subsequently detected this block and incorrectly invoked nilfs_direct_propagate() on it, which is designed to handle only data blocks in direct mapping. B-tree nodes in the cache are managed by virtual block numbers, and their logical keys typically exceed the range expected by direct mapping. Consequently, processing such a node as a direct mapping entry triggers a slab-out-of-bounds access. The root cause is that when a B-tree mapping collapses into a direct mapping during truncation, an intermediate node block pointed to by the root node is left behind as garbage instead of being explicitly deleted. This resolves the issue by adding a nilfs_btree_discard() operation to delete the remaining intermediate node block during the conversion. A 'deform' flag is added to the bop_delete interface to explicitly signal that the deletion is part of a mapping transformation. This allows the B-tree mapping implementation to perform the necessary cleanup and discarding of the residual node structure that would be otherwise be left orphaned after the transition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89723
EUVD
EUVD-2026-76635

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a slab-out-of-bounds error in the nilfs2 file system. After truncating a file, an intermediate B-tree node block remains in the cache in a dirty state. The log writer incorrectly processes this block using nilfs_direct_propagate(), which is meant only for direct mapping data blocks. This triggers a slab-out-of-bounds access because B-tree nodes use virtual block numbers exceeding direct mapping ranges.

Detection Guidance

This vulnerability is specific to the Linux kernel's nilfs2 filesystem and requires kernel-level detection. Check if your system uses nilfs2 with commands like 'mount | grep nilfs2' or 'lsmod | grep nilfs2'. Monitor kernel logs for slab-out-of-bounds errors using 'dmesg | grep -i slab' or 'journalctl -k | grep -i slab'.

Impact Analysis

This vulnerability could lead to system crashes or instability due to memory corruption. An attacker with local access might exploit it to cause denial-of-service conditions or potentially execute arbitrary code with kernel privileges. Data corruption in the file system is also possible if the slab-out-of-bounds error corrupts critical memory structures.

Mitigation Strategies

Update your Linux kernel to the latest patched version. If using nilfs2, unmount and remount the filesystem to clear any corrupted state. Avoid truncating files on nilfs2 partitions until patched. Monitor filesystem integrity with tools like fsck.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89723. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart