{"id":"CVE-2026-89723","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-89723","summary":"nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation\n\nShuangpeng Bai reported that KASAN detected a slab-out-of-bounds error\nin nilfs_direct_propagate() during testing.\n\nAnalysis revealed that after truncating a file, a node block immediately\nbelow the B-tree root was not deleted.  Instead, it remained in the B-tree\nnode cache in a dirty state.  The log writer subsequently detected this\nblock and incorrectly invoked nilfs_direct_propagate() on it, which is\ndesigned to handle only data blocks in direct mapping.\n\nB-tree nodes in the cache are managed by virtual block numbers, and their\nlogical keys typically exceed the range expected by direct mapping.\nConsequently, processing such a node as a direct mapping entry triggers\na slab-out-of-bounds access.\n\nThe root cause is that when a B-tree mapping collapses into a direct\nmapping during truncation, an intermediate node block pointed to by the\nroot node is left behind as garbage instead of being explicitly deleted.\n\nThis resolves the issue by adding a nilfs_btree_discard() operation\nto delete the remaining intermediate node block during the conversion.\nA 'deform' flag is added to the bop_delete interface to explicitly signal\nthat the deletion is part of a mapping transformation.  This allows the\nB-tree mapping implementation to perform the necessary cleanup and\ndiscarding of the residual node structure that would be otherwise be left\norphaned after the transition.","published":"2026-09-11T19:46:35.161Z","modified":"2026-09-14T03:46:26.497180243Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.12.109"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/28362e8ce51377afdec1782e661e808328a10514"},{"type":"WEB","url":"https://git.kernel.org/stable/c/448636c745a3f3b8582a0b8ce718c890a11c0fa9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/45662dedb8f272ef7f16e69f13424c4bd0399240"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5d3783c451a546373662ee11ec17019273e68034"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89723.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89723"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-14T03:46:26.497180243Z"}}