CVE-2026-89965: Linux Kernel NVDIMM BTT Buffer Overflow

CVE-2026-89965 Overview

CVE-2026-89965 is an out-of-bounds write vulnerability in the Linux kernel's nvdimm/btt (Block Translation Table) subsystem. The BTT info block's nfree field, which specifies the number of reserve free blocks, is read from the storage medium without validation. Functions btt_freelist_init() and btt_rtt_init() size the per-lane freelist[] and rtt[] arrays using nfree, but the I/O path indexes them by a lane bounded by nd_region->num_lanes (ND_MAX_LANES). A crafted or foreign arena with nfree below the lane count causes out-of-bounds memory writes during I/O operations.

Critical Impact
A local attacker with the ability to present a crafted NVDIMM arena can trigger kernel memory corruption, leading to privilege escalation or system compromise.

Affected Products

Linux kernel with CONFIG_BTT enabled and nvdimm/btt driver support
Systems using NVDIMM (Non-Volatile Dual In-line Memory Module) storage with BTT
Multiple stable kernel branches referenced across eight upstream commits

Discovery Timeline

2026-09-16 - CVE-2026-89965 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89965

Vulnerability Analysis

The Block Translation Table (BTT) is a Linux kernel mechanism providing atomic sector-write semantics on top of persistent memory. Each BTT arena maintains metadata describing nfree, the count of reserve free blocks used to guarantee atomic updates.

During arena discovery, the kernel trusts the on-media nfree value and uses it to allocate the per-lane freelist[] and rtt[] arrays. However, the I/O submission path acquires a lane index through nd_region_acquire_lane(), which is bounded by nd_region->num_lanes (equal to ND_MAX_LANES) rather than by nfree. When nfree is smaller than num_lanes, lane indices exceed the array bounds and produce out-of-bounds writes into kernel heap memory.

The btt.rst documentation defines the invariant nlanes = min(nfree, num_cpus), but the code did not enforce it. The fix rejects any arena whose nfree is less than num_lanes at discovery time, before the per-lane arrays are allocated.

Root Cause

The root cause is missing input validation on attacker-influenced metadata. The nfree field from the BTT info block was accepted without a bounds check against the actual lane count used by the I/O path, breaking a documented invariant [CWE-787].

Attack Vector

Exploitation requires local access and the ability to mount or attach a crafted NVDIMM namespace with a malicious BTT arena. When the arena is discovered, the mismatch between nfree and num_lanes causes subsequent I/O to write past the allocated freelist[] or rtt[] arrays, corrupting adjacent kernel structures.

See the upstream commits referenced under Kernel Commit 59d5cd1 and Kernel Commit 6a1f2e5 for the validation logic added at arena discovery.

// No verified proof-of-concept code is available.
// The vulnerability is described in prose based on upstream commit messages.

Detection Methods for CVE-2026-89965

Indicators of Compromise

Unexpected kernel oops, panic, or slab corruption messages referencing btt_freelist_init, btt_rtt_init, or nd_region_acquire_lane in dmesg or the kernel ring buffer.
Attachment of unrecognized or foreign NVDIMM namespaces prior to a kernel fault.
KASAN reports indicating out-of-bounds writes within the nvdimm/btt code paths.

Detection Strategies

Monitor kernel logs for BTT-related warnings, faults, and KASAN out-of-bounds write reports.
Audit ndctl list output on systems using persistent memory to enumerate BTT arenas and detect unfamiliar namespaces.
Correlate insmod, modprobe, or namespace attachment events with kernel crashes affecting nd_btt.

Monitoring Recommendations

Ingest kernel logs into a centralized logging or SIEM platform and alert on nd_btt faults.
Track running kernel versions across the fleet to identify unpatched hosts exposing the nvdimm/btt driver.
Enable auditd rules on device nodes under /dev/nd* to record attachment activity.

How to Mitigate CVE-2026-89965

Immediate Actions Required

Apply the vendor-supplied kernel update that enforces the nfree >= num_lanes invariant at arena discovery.
Restrict local privileged access to systems exposing NVDIMM devices and the nd_btt driver.
Inventory hosts with persistent memory (PMEM/NVDIMM) hardware and prioritize them for patching.

Patch Information

The fix is available across multiple stable branches. Reference commits: Kernel Commit 59d5cd1, Kernel Commit 6a1f2e5, Kernel Commit 6b1faf1, Kernel Commit 6f79d1a, Kernel Commit 9dfa11c, Kernel Commit eb49134, Kernel Commit f6c5313, and Kernel Commit f9bf05c. Consume the fix through your Linux distribution's kernel update channel.

Workarounds

Blacklist the nd_btt kernel module on hosts that do not require BTT functionality.
Prevent attachment of untrusted NVDIMM namespaces and disable BTT modes on foreign devices using ndctl.
Enforce strict access controls on physical hardware and administrative accounts able to attach persistent memory devices.

bash

# Blacklist the nd_btt module to prevent loading on unpatched systems
echo "blacklist nd_btt" | sudo tee /etc/modprobe.d/blacklist-nd_btt.conf
sudo update-initramfs -u

# Enumerate BTT namespaces to identify exposed arenas
sudo ndctl list --namespaces --mode=sector