Look up another CVE · open CVE-2026-89723 in the interactive tracker
CVE-2026-89723
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem fs/nilfs2. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-89723 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfs_direct_propagate() during testing. Analysis revealed that after truncating a file, a node block immediately below the B-tree root was not deleted. Instead, it remained in the B-tree node cache in a dirty state. The log writer subsequently detected this block and incorrectly invoked nilfs_direct_propagate() on it, which is designed to handle only data blocks in direct mapping. B-tree nodes in the cache are managed by virtual block numbers, and their logical keys typically exceed the range expected by direct mapping. Consequently, processing such a node as a direct mapping entry triggers a slab-out-of-bounds access. The root cause is that when a B-tree mapping collapses into a direct mapping during truncation, an intermediate node block pointed to by the root node is left behind as garbage instead of being explicitly deleted. This resolves the issue by adding a nilfs_btree_discard() operation to delete the remaining intermediate node block during the conversion. A 'deform' flag is added to the bop_delete interface to explicitly signal that the deletion is part of a mapping transformation. This allows the B-tree mapping implementation to perform the necessary cleanup and discarding of the residual node structure that would be otherwise be left orphaned after the transition.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/nilfs2/bmap.c
fs/nilfs2/bmap.h
fs/nilfs2/btree.c
fs/nilfs2/direct.c
- What this is
- NILFS2 FILESYSTEMMAINTAINERS section matched on fs/nilfs2/ · linux-nilfs@vger.kernel.org · Maintained
- Kernel module
- nilfs2
Check it on the machine
grep -w CONFIG_NILFS2_FS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w nilfs2Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookworm, trixie, forky, sid, bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_NILFS2_FS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/nilfs2
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.30 | 5.10.270 | 39005fd1ce65 |
| 2.6.30 | 5.15.221 | bf49e6f6ddc1 |
| 2.6.30 | 6.1.188 | 4a1bb1f9f24a |
| 2.6.30 | 6.6.157 | b313edfbc0c2 |
| 2.6.30 | 6.12.109 | 5d3783c451a5 |
| 2.6.30 | 6.18.50 | 448636c745a3 |
| 2.6.30 | 7.2.4 | 28362e8ce513 |
| 2.6.30 | 7.3 | 45662dedb8f2 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The defect is reached only through local VFS operations on a mounted nilfs2 volume (write to grow a file into B-tree mapping, ftruncate/setattr to collapse it to direct mapping, then the in-kernel log writer). No network protocol path enters fs/nilfs2/direct.c.
- AC:LAttack complexity, low
- The leftover dirty B-tree node after truncation is a deterministic logic bug, not a race. The attacker controls file layout and size, and can force the segment constructor to process the orphaned node via fsync/sync or the periodic log writer.
- PR:LPrivileges required, low
- Write and truncate go through nilfs_setattr/nilfs_truncate with only ordinary file DAC checks; CAP_SYS_ADMIN in fs/nilfs2/ioctl.c is not on this path. An unprivileged user with write access to an already-mounted nilfs2 volume can trigger it.
- UI:NUser interaction, none
- On an already-mounted nilfs2 volume the attacker triggers the B-tree-to-direct conversion and the subsequent slab OOB entirely with their own write/ftruncate/fsync; no separate victim action is required.
- S:UScope, unchanged
- The slab out-of-bounds access corrupts kernel memory within the same kernel security authority; this is local memory corruption/privilege escalation, not a VM, IOMMU, or sandbox boundary crossing.
- C:HConfidentiality impact, high
- nilfs_direct_propagate indexes the 6-entry direct-pointer array with the leftover B-tree node's virtual block number via nilfs_direct_get_ptr, an unbounded slab out-of-bounds read of adjacent nilfs_inode_info/slab memory that can disclose kernel data.
- I:HIntegrity impact, high
- For a non-volatile leftover node, nilfs_direct_set_ptr writes a newly allocated DAT vblock at the same unbounded OOB index, and the OOB-read pointer is passed to nilfs_dat_prepare_update, yielding a kernel write primitive and DAT metadata corruption.
- A:HAvailability impact, high
- The unbounded slab-out-of-bounds access was caught by KASAN and produces a kernel oops/panic when the out-of-range index lands outside mapped slab objects, taking the system down.