---
id: CVE-2026-89723
title: 'nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation

  Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error
  in nilfs_direct_propag…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 36a580eb489f54d81a0534974962e732a314b999 <
    39005fd1ce654ffdecacddc406b9a038efe606e6
  - >-
    Linux >= 36a580eb489f54d81a0534974962e732a314b999 <
    bf49e6f6ddc12445a0330708b365de6458085980
  - >-
    Linux >= 36a580eb489f54d81a0534974962e732a314b999 <
    4a1bb1f9f24a935c9b3f4fbf98012fa6d4ad826d
  - >-
    Linux >= 36a580eb489f54d81a0534974962e732a314b999 <
    b313edfbc0c2a60f7ce09b2e81ee71909ab8ddaf
  - >-
    Linux >= 36a580eb489f54d81a0534974962e732a314b999 <
    5d3783c451a546373662ee11ec17019273e68034
  - >-
    Linux >= 36a580eb489f54d81a0534974962e732a314b999 <
    448636c745a3f3b8582a0b8ce718c890a11c0fa9
  - >-
    Linux >= 36a580eb489f54d81a0534974962e732a314b999 <
    28362e8ce51377afdec1782e661e808328a10514
  - >-
    Linux >= 36a580eb489f54d81a0534974962e732a314b999 <
    45662dedb8f272ef7f16e69f13424c4bd0399240
  - Linux 2.6.30
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:51:35.942Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89723'
references:
  - url: 'https://git.kernel.org/stable/c/39005fd1ce654ffdecacddc406b9a038efe606e6'
  - url: 'https://git.kernel.org/stable/c/bf49e6f6ddc12445a0330708b365de6458085980'
  - url: 'https://git.kernel.org/stable/c/4a1bb1f9f24a935c9b3f4fbf98012fa6d4ad826d'
  - url: 'https://git.kernel.org/stable/c/b313edfbc0c2a60f7ce09b2e81ee71909ab8ddaf'
  - url: 'https://git.kernel.org/stable/c/5d3783c451a546373662ee11ec17019273e68034'
  - url: 'https://git.kernel.org/stable/c/448636c745a3f3b8582a0b8ce718c890a11c0fa9'
  - url: 'https://git.kernel.org/stable/c/28362e8ce51377afdec1782e661e808328a10514'
  - url: 'https://git.kernel.org/stable/c/45662dedb8f272ef7f16e69f13424c4bd0399240'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89723.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89723'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532191'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89723'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89723'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89723.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00169
epssPercentile: 0.06193
scores:
  cna: 7.8
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.449Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation

Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error
in nilfs_direct_propagate() during testing.

Analysis revealed that after truncating a file, a node block immediately
below the B-tree root was not deleted.  Instead, it remained in the B-tree
node cache in a dirty state.  The log writer subsequently detected this
block and incorrectly invoked nilfs_direct_propagate() on it, which is
designed to handle only data blocks in direct mapping.

B-tree nodes in the cache are managed by virtual block numbers, and their
logical keys typically exceed the range expected by direct mapping.
Consequently, processing such a node as a direct mapping entry triggers
a slab-out-of-bounds access.

The root cause is that when a B-tree mapping collapses into a direct
mapping during truncation, an intermediate node block pointed to by the
root node is left behind as garbage instead of being explicitly deleted.

This resolves the issue by adding a nilfs_btree_discard() operation
to delete the remaining intermediate node block during the conversion.
A 'deform' flag is added to the bop_delete interface to explicitly signal
that the deletion is part of a mapping transformation.  This allows the
B-tree mapping implementation to perform the necessary cleanup and
discarding of the residual node structure that would be otherwise be left
orphaned after the transition.

## Affected

- `Linux >= 36a580eb489f54d81a0534974962e732a314b999 < 39005fd1ce654ffdecacddc406b9a038efe606e6`
- `Linux >= 36a580eb489f54d81a0534974962e732a314b999 < bf49e6f6ddc12445a0330708b365de6458085980`
- `Linux >= 36a580eb489f54d81a0534974962e732a314b999 < 4a1bb1f9f24a935c9b3f4fbf98012fa6d4ad826d`
- `Linux >= 36a580eb489f54d81a0534974962e732a314b999 < b313edfbc0c2a60f7ce09b2e81ee71909ab8ddaf`
- `Linux >= 36a580eb489f54d81a0534974962e732a314b999 < 5d3783c451a546373662ee11ec17019273e68034`
- `Linux >= 36a580eb489f54d81a0534974962e732a314b999 < 448636c745a3f3b8582a0b8ce718c890a11c0fa9`
- `Linux >= 36a580eb489f54d81a0534974962e732a314b999 < 28362e8ce51377afdec1782e661e808328a10514`
- `Linux >= 36a580eb489f54d81a0534974962e732a314b999 < 45662dedb8f272ef7f16e69f13424c4bd0399240`
- `Linux 2.6.30`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89723.json)