CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix extent map leak in NOCOW direct I/O write
btrfsdioiomapbegin() calls btrfsgetextent(), which returns an extent map reference that must be dropped on all exit paths.
For direct writes into a NOCOW range, btrfsgetblocksdirectwrite() keeps using that extent map and asks btrfscreatedioextent() to allocate the ordered extent. If that fails, for example because btrfsallocorderedextent() fails, the function returns the error without dropping the input extent map. The PREALLOC path avoided this by dropping the input extent map before replacing it with the newly created one.
Check the error from btrfscreatedioextent() before replacing the map and drop the input extent map on failure.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the leak?
The affected path requires a direct I/O write into a Btrfs NOCOW range. The leak occurs when creation of the direct-I/O ordered extent fails, such as when ordered-extent allocation fails.
What is the impact of a failed operation on this path?
On the specified error path, the input extent map reference is not dropped. This causes an extent map reference leak.
Is the PREALLOC direct-write path affected in the same way?
No. The description states that the PREALLOC path already drops the input extent map before replacing it with the newly created map.