CVE-2026-89772 Overview
CVE-2026-89772 is a Linux kernel vulnerability in the Btrfs filesystem. A regression removed the folio_clear_dirty_for_io() call in extent_write_cache_pages(), replacing it with a plain folio_test_dirty() check. The removed call also invoked folio_mkclean(), which write-protects shared mmap PTEs mapping the folio. Without this write protection, a process holding a memory map of a file can modify folio contents while writeback expects stable data. This creates data integrity issues during checksumming, compression, and copying operations. The flaw has been resolved upstream through kernel commits 074c715 and 5376c9d.
Critical Impact
Concurrent mmap writes during Btrfs writeback can cause checksum mismatches, lost writes across fsync(), corrupted compressed extents, and persistence of data past end-of-file.
Affected Products
- Linux kernel with Btrfs filesystem support
- Kernel versions containing commit 095be159f3eb ("btrfs: unify folio dirty flag clearing")
- Kernel versions containing commit a4ef54dbb576 ("btrfs: make extent_range_clear_dirty_for_io() to handle sector size < page size cases")
Discovery Timeline
- 2026-09-11 - CVE-2026-89772 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89772
Vulnerability Analysis
The vulnerability affects the Btrfs writeback path. Commit 095be159f3eb replaced the folio_clear_dirty_for_io() call in extent_write_cache_pages() with a plain folio_test_dirty() check. The removed helper performed two actions: clearing the dirty flag and invoking folio_mkclean() to write-protect shared mmap page table entries.
Btrfs still calls folio_clear_dirty_for_io() later in submit_one_sector() when clearing dirty on the last sector of the folio. However, the earlier write-protection step is lost. A process with the file mapped can modify a sector while writeback is in progress, without triggering a page fault.
This breaks the stable-folio guarantee required by checksumming, compression, and copy paths. The impact spans five concrete scenarios: partial bio submissions on large folios or subpage sectorsize, zoned batch submissions in lock_delalloc_folios(), inline extents, folios spanning end-of-file, and compressed extents processed by run_delalloc_compressed().
Root Cause
The root cause is the removal of an implicit folio_mkclean() call when the dirty clearing helper was replaced with a simple state test. The functional dirty state check no longer performs the associated PTE write-protection needed to prevent concurrent mmap writes during writeback.
Attack Vector
Exploitation requires a local process with an existing writable memory map of a Btrfs-backed file. Writes performed through the mapping during the writeback window bypass the fault handler and modify folio contents mid-flight. This produces invalid checksums flagged on subsequent reads, lost writes not tracked by dirty state, corrupted compressed data, or persistence of bytes past EOF.
See the upstream fix references for the exact code path: Kernel commit 074c715 and Kernel commit 5376c9d.
Detection Methods for CVE-2026-89772
Indicators of Compromise
- Kernel log messages from Btrfs reporting checksum failures (csum failed) on files that were not modified after last successful read.
- Reports of lost writes surviving fsync() on mmap-backed files stored on Btrfs.
- Corrupted compressed extents identified during btrfs scrub runs.
Detection Strategies
- Enumerate running kernel version and compare against distribution advisories referencing commits 074c715 and 5376c9d.
- Audit workloads that combine mmap writes with heavy writeback on Btrfs volumes, including databases and build systems.
- Correlate btrfs scrub output with process telemetry to identify processes holding writable mappings during corruption windows.
Monitoring Recommendations
- Collect dmesg output for Btrfs checksum, corruption, and transaction-abort events into a centralized log store.
- Schedule periodic btrfs scrub on all Btrfs volumes and alert on any error counters that increment.
- Track kernel package versions across the fleet and flag hosts still running vulnerable builds.
How to Mitigate CVE-2026-89772
Immediate Actions Required
- Apply the vendor kernel update containing the fixes referenced by commits 074c715 and 5376c9d as soon as your distribution publishes them.
- Reboot affected hosts after the kernel package upgrade to activate the patched writeback path.
- Run btrfs scrub after patching to detect any latent corruption introduced before the fix.
Patch Information
The fix is upstream in the mainline Linux kernel. Refer to Kernel commit 074c715 and Kernel commit 5376c9d. Deploy the kernel version shipped by your distribution that incorporates these commits.
Workarounds
- Avoid workloads that perform concurrent mmap writes and heavy writeback on Btrfs volumes until the patched kernel is deployed.
- Consider migrating high-risk workloads to a different filesystem temporarily if patching cannot be scheduled.
- Disable Btrfs transparent compression where feasible to narrow the corruption surface until the fix is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.