CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix extent map leak in NOCOW direct I/O write

btrfsdioiomapbegin() calls btrfsgetextent(), which returns an extent map reference that must be dropped on all exit paths.

For direct writes into a NOCOW range, btrfsgetblocksdirectwrite() keeps using that extent map and asks btrfscreatedioextent() to allocate the ordered extent. If that fails, for example because btrfsallocorderedextent() fails, the function returns the error without dropping the input extent map. The PREALLOC path avoided this by dropping the input extent map before replacing it with the newly created one.

Check the error from btrfscreatedioextent() before replacing the map and drop the input extent map on failure.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 11, 2026
CVE Published
via MITRE·07:45 PM
Data Sourced
via MITRE·07:45 PM
Description

Frequently Asked Questions

1

What conditions are required to trigger the leak?

The affected path requires a direct I/O write into a Btrfs NOCOW range. The leak occurs when creation of the direct-I/O ordered extent fails, such as when ordered-extent allocation fails.

2

What is the impact of a failed operation on this path?

On the specified error path, the input extent map reference is not dropped. This causes an extent map reference leak.

3

Is the PREALLOC direct-write path affected in the same way?

No. The description states that the PREALLOC path already drops the input extent map before replacing it with the newly created map.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203