{"id":"CVE-2026-89723","revision":"ca0268066e944fd589c5d114c6f6c934","records":[{"revision":"ca0268066e944fd589c5d114c6f6c934","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89723","aliases":[],"title":"nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation\n\nShuangpeng Bai reported that KASAN detected a slab-out-of-bounds error\nin nilfs_direct_propagate() during testing.\n\nAnalysis revealed that after truncating a file, a node block immediately\nbelow the B-tree root was not deleted.  Instead, it remained in the B-tree\nnode cache in a dirty state.  The log writer subsequently detected this\nblock and incorrectly invoked nilfs_direct_propagate() on it, which is\ndesigned to handle only data blocks in direct mapping.\n\nB-tree nodes in the cache are managed by virtual block numbers, and their\nlogical keys typically exceed the range expected by direct mapping.\nConsequently, processing such a node as a direct mapping entry triggers\na slab-out-of-bounds access.\n\nThe root cause is that when a B-tree mapping collapses into a direct\nmapping during truncation, an intermediate node block pointed to by the\nroot node is left behind as garbage instead of being explicitly deleted.\n\nThis resolves the issue by adding a nilfs_btree_discard() operation\nto delete the remaining intermediate node block during the conversion.\nA 'deform' flag is added to the bop_delete interface to explicitly signal\nthat the deletion is part of a mapping transformation.  This allows the\nB-tree mapping implementation to perform the necessary cleanup and\ndiscarding of the residual node structure that would be otherwise be left\norphaned after the transition.","state":0,"publishedAt":"2026-09-11T19:46:35.161+00:00","modifiedAt":"2026-10-19T08:51:35.942+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nilfs2/bmap.c\",\n                        \"fs/nilfs2/bmap.h\",\n                        \"fs/nilfs2/btree.c\",\n                        \"fs/nilfs2/direct.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"36a580eb489f54d81a0534974962e732a314b999\",\n                            \"lessThan\": \"39005fd1ce654ffdecacddc406b9a038efe606e6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"36a580eb489f54d81a0534974962e732a314b999\",\n                            \"lessThan\": \"bf49e6f6ddc12445a0330708b365de6458085980\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"36a580eb489f54d81a0534974962e732a314b999\",\n                            \"lessThan\": \"4a1bb1f9f24a935c9b3f4fbf98012fa6d4ad826d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"36a580eb489f54d81a0534974962e732a314b999\",\n                            \"lessThan\": \"b313edfbc0c2a60f7ce09b2e81ee71909ab8ddaf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"36a580eb489f54d81a0534974962e732a314b999\",\n                            \"lessThan\": \"5d3783c451a546373662ee11ec17019273e68034\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"36a580eb489f54d81a0534974962e732a314b999\",\n                            \"lessThan\": \"448636c745a3f3b8582a0b8ce718c890a11c0fa9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"36a580eb489f54d81a0534974962e732a314b999\",\n                            \"lessThan\": \"28362e8ce51377afdec1782e661e808328a10514\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"36a580eb489f54d81a0534974962e732a314b999\",\n                            \"lessThan\": \"45662dedb8f272ef7f16e69f13424c4bd0399240\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/nilfs2/bmap.c\",\n                        \"fs/nilfs2/bmap.h\",\n                        \"fs/nilfs2/btree.c\",\n                        \"fs/nilfs2/direct.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.30\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.30\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.109\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/39005fd1ce654ffdecacddc406b9a038efe606e6","https://git.kernel.org/stable/c/bf49e6f6ddc12445a0330708b365de6458085980","https://git.kernel.org/stable/c/4a1bb1f9f24a935c9b3f4fbf98012fa6d4ad826d","https://git.kernel.org/stable/c/b313edfbc0c2a60f7ce09b2e81ee71909ab8ddaf","https://git.kernel.org/stable/c/5d3783c451a546373662ee11ec17019273e68034","https://git.kernel.org/stable/c/448636c745a3f3b8582a0b8ce718c890a11c0fa9","https://git.kernel.org/stable/c/28362e8ce51377afdec1782e661e808328a10514","https://git.kernel.org/stable/c/45662dedb8f272ef7f16e69f13424c4bd0399240"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89723","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89723","identifiers":["CVE-2026-89723"]},"retained":false,"historicalAffected":[]}],"coverage":[]}