CVE-2026-89644: Linux Kernel Information Disclosure Vulnerability

CVE-2026-89644 Overview

CVE-2026-89644 is a memory leak vulnerability in the Linux kernel's Btrfs filesystem. The flaw resides in the direct I/O write path when handling NOCOW (No Copy-On-Write) ranges. Specifically, btrfs_dio_iomap_begin() obtains an extent map reference through btrfs_get_extent() that must be released on every exit path. When btrfs_create_dio_extent() fails during ordered extent allocation, the input extent map reference is not dropped, resulting in a resource leak. The bug affects local filesystem operations on Btrfs volumes configured with NOCOW attributes.

Critical Impact
Repeated failures in the NOCOW direct I/O write path can leak extent map objects, gradually exhausting kernel memory and degrading system stability on Btrfs-backed storage.

Affected Products

Linux kernel (Btrfs filesystem subsystem)
Distributions shipping affected kernel versions with Btrfs enabled
Systems using NOCOW attributes on Btrfs volumes for direct I/O workloads

Discovery Timeline

2026-09-11 - CVE-2026-89644 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89644

Vulnerability Analysis

The vulnerability is a memory leak in the Btrfs direct I/O write path. btrfs_dio_iomap_begin() invokes btrfs_get_extent(), which returns a reference-counted extent map object. Convention requires callers to drop that reference on every exit path.

For direct writes into a NOCOW range, btrfs_get_blocks_direct_write() retains the extent map reference and passes it to btrfs_create_dio_extent() to allocate an ordered extent. If allocation fails, for example because btrfs_alloc_ordered_extent() returns an error, the function returns without dropping the input extent map.

The existing PREALLOC path handled this correctly by dropping the input extent map before replacing it with a newly created one. The NOCOW branch omitted the equivalent cleanup. Each failure occurrence leaks one extent map structure from kernel slab memory.

Root Cause

The root cause is a missing reference-count decrement on an error path. The extent map object is reference counted, and unbalanced references prevent the object from being freed. This is a classic Memory Leak pattern where an allocation succeeds but a subsequent failure short-circuits the cleanup logic.

Attack Vector

Exploitation requires local access to a system with Btrfs mounted and NOCOW attributes set on target files. Workloads issuing direct I/O writes against NOCOW ranges may trigger the leak when ordered extent allocation fails, such as under memory pressure. Sustained triggering can degrade filesystem performance and consume kernel slab memory over time. This vulnerability is not a remote code execution primitive.

The fix, applied in commits 05a1a81, 3f95086, and f42efd63, checks the return value of btrfs_create_dio_extent() before replacing the map and drops the input extent map on failure.

Detection Methods for CVE-2026-89644

Indicators of Compromise

Growing btrfs_extent_map slab cache size visible in /proc/slabinfo without corresponding filesystem activity growth.
Kernel memory pressure or OOM events on hosts running Btrfs workloads with NOCOW-flagged files.
Repeated btrfs_alloc_ordered_extent failures logged via dmesg on affected kernels.

Detection Strategies

Compare running kernel version against fixed commits listed in the kernel.org stable tree references.
Monitor slab allocator statistics for anomalous growth in Btrfs extent map objects using slabtop or eBPF probes.
Enable kernel memory leak detection (kmemleak) on test systems to surface unreleased extent map allocations.

Monitoring Recommendations

Track kernel slab memory trends over time and alert on sustained growth of Btrfs-specific caches.
Correlate Btrfs error messages in system logs with periods of memory pressure.
Audit Btrfs subvolumes for files with the NOCOW attribute (chattr +C) to identify systems that expose the vulnerable code path.

How to Mitigate CVE-2026-89644

Immediate Actions Required

Identify all Linux hosts running Btrfs and inventory kernel versions against the fixed commits.
Prioritize patching systems that use NOCOW attributes for direct I/O workloads such as virtual machine images or database files.
Schedule kernel updates through your distribution's stable update channel as fixes propagate.

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Review the upstream commits: Kernel Git Commit 05a1a81, Kernel Git Commit 3f95086, and Kernel Git Commit f42efd63. Apply the vendor-provided kernel package from your distribution once it includes these commits, then reboot to activate the patched kernel.

Workarounds

Reduce or eliminate NOCOW attribute use where feasible to avoid the vulnerable code branch.
Ensure sufficient free memory to reduce the likelihood of btrfs_alloc_ordered_extent failures that trigger the leak.
Restrict local user access on multi-tenant Btrfs hosts pending patch deployment.

bash

# Check current kernel version
uname -r

# List files with NOCOW attribute on a Btrfs mount
lsattr -R /mnt/btrfs 2>/dev/null | grep -- '-C-'

# Monitor Btrfs extent map slab usage
grep btrfs_extent_map /proc/slabinfo