From mboxrd@z Thu Jan 1 00:00:00 1970 From: AL-KERNEL To: kernel-cve@kernelcve.org Subject: [CVE-2026-89644][LOW] btrfs: fix extent map leak in NOCOW direct I/O write Date: Sat, 12 Sep 2026 03:03:58 -0400 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-AL-KERNEL-CVE: CVE-2026-89644 X-AL-KERNEL-Priority: LOW X-AL-KERNEL-Severity: LOW X-AL-KERNEL-Base-Severity: LOW X-AL-KERNEL-KPANIC: NO X-AL-KERNEL-ActionableScore: 2 X-AL-KERNEL-ActionableScore-Lower: unknown X-AL-KERNEL-Commit: f42efd634c0ae7ba0ce2fc5e30e291b0803b0ae2 List-Id: CVE: CVE-2026-89644 Priority: LOW AL-KERNEL base severity: LOW KPANIC flag: NO Patch: btrfs: fix extent map leak in NOCOW direct I/O write Commit: f42efd634c0ae7ba0ce2fc5e30e291b0803b0ae2 Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f42efd634c0ae7ba0ce2fc5e30e291b0803b0ae2 Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89644 Analysis date: Sat, 12 Sep 2026 03:03:58 -0400 ActionableScore: 2 ActionableScore lower bound: unknown Actionable bucket: Ordinary Moderate Manual review required: NO Summary: No one-sentence report phrase was found. ====================================================================== ABOUT THIS REPORT ====================================================================== The original Linux kernel CVE announcement for CVE-2026-89644 is available here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89644 The original announcement does not normally provide a security severity estimate, CVSS assessment, or enough information to determine whether the reported kernel bug represents a practically relevant security issue. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. It combines an autonomous classifier with LLM-assisted technical analysis and a separate ActionableScore mechanism. The purpose of this report is to prioritize Linux kernel CVEs before manual review, identify cases that require prompt investigation, and support automatic closure of issues that are unlikely to have meaningful security impact. Published priority for this report: LOW Manual review required: NO A detailed explanation of the methodology and priority rules is included at the end of this message. ====================================================================== AL-KERNEL CLASSIFICATION RESULT ====================================================================== CVE-2026-89644 LOW https://www.kernelcve.org/list/?q=CVE-2026-89644 CHECK WITH IMPACT FROM ORIG NN NONE Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H';*CWE-401;*CWE-772;**CWE-400;Other CVSS 'AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L';BEST CVSS score: '4.7';DESCR 'A Btrfs extent map reference can be leaked in the NOCOW direct I/O write error path because btrfs_get_blocks_direct_write() may return after btrfs_create_dio_extent() fails without dropping the extent map returned by btrfs_get_extent(). A local user with write access to an affected Btrfs NOCOW file may be able to trigger the leak through O_DIRECT writes, but reliable triggering also depends on the ordered extent allocation failure path. For the CVSS the PR:L is used because local code execution or a local process with file write access is required, not merely network reachability. The issue is not network reachable. Impact is denial of service through kernel memory or reference leakage under repeated attempts. No direct confidentiality or integrity impact is supported by the patch context.';NO MANUAL CHECK; ,and ActionableScore result is Ordinary Moderate (with actual score 2) YES WRITE OOB DISK INIT SIMPLEFIX LEAK SKIP NO NO checked ====================================================================== ACTIONABLESCORE ANALYSIS ====================================================================== ActionableScore=2 PrimitiveClass=CLASS_C RealUAF=NO HostAdminRequired=NO NamespaceScopedPrivilege=NO ImportantCandidate=NO ManualReview=NO AutoDowngradeAllowed=YES 1. ActionableScore * Raw conservative score: 2 * Conservative score: 2 * Raw paranoid score: 2 * Paranoid score: 2 * No floor or cap changed the score. * Final recommended bucket: **Ordinary Moderate**:: 2. Signal breakdown Positive signals: * +1 Concrete persistent kernel resource/reference leak. The patch directly establishes that an extent_map reference returned by btrfs_get_extent() is not dropped on the btrfs_create_dio_extent() error path. * +1 Local below-host-admin reachability. A local process with write access to an affected Btrfs NOCOW file can reach the direct I/O write path without host-admin-equivalent privilege. Negative or non-awarded signals: * +0 Real UAF not awarded. The bug is a missing extent_map reference release, not a stale post-free use. * +0 Concrete repeated release/refcount not awarded. The issue is a missing release, not a second release through a dangling reference. * +0 Reliable kernel crash not awarded. The supplied evidence supports a leak and possible resource exhaustion, not an immediate panic. * +0 Confidentiality and integrity not awarded. No disclosure, unauthorized write, COW ownership violation, metadata corruption, or security-boundary bypass is established. * +0 Strong DoS escalation not awarded. Repeated failures may accumulate leaked references, but the triggering path depends on ordered extent allocation failure and does not show immediate host-wide failure. * +0 Filesystem ownership/COW signal not awarded. The patch concerns an internal extent_map reference leak, not writes crossing ownership boundaries. * +0 Manual-review memory-corruption signal not awarded. No UAF, OOB, arbitrary write, controlled reclaim, or active stale-object processing is shown. Repeated-release/refcount checklist: * First release can end lifetime: not applicable. * Exact same reference survives after first release: not applicable. * Second operation is a real lifetime/refcount mutation: no. * +1 Concrete repeated release/refcount awarded: no. * Paranoid repeated-refcount leverage +1 awarded: no. * FLOOR 5 applied: no. 3. Reachability analysis The vulnerable path is local filesystem activity in Btrfs direct I/O writes to a NOCOW range. A normal local user can potentially reach the path if they have write access to an affected file and use O_DIRECT style writes, so host-admin-equivalent privilege is not established as required. The complete trigger is still constrained because the leak occurs only when btrfs_create_dio_extent() fails, for example through btrfs_alloc_ordered_extent() failure. That is an error path and may require memory or resource pressure, but it is not a race and no special timing window is established. No network reachability is established. No namespace-scoped capability is involved. Prior setup may include an existing Btrfs filesystem and a NOCOW file or range, but no special hardware or rare execution mode is required. 4. Primitive and severity interpretation The exact primitive is a persistent kernel reference/resource leak of an extent_map object. This is not an active structured UAF and not fixed stale storage being used after free. It is a missing put/free on one error path. The demonstrated consequence is gradual resource leakage. The plausible operational consequence is local denial of service if the leak can be accumulated repeatedly under the required failure conditions. The speculative consequence would be broader memory pressure, but no memory corruption, privilege escalation, arbitrary read/write, or filesystem ownership violation is supported. PrimitiveClass is CLASS_C because the behavior is a DoS/resource-management defect without an independently useful corruption primitive. ImportantCandidate is NO because the patch does not establish memory corruption, boundary bypass, repeated stale refcount mutation, or COW/security ownership violation. AutoDowngradeAllowed is YES because the issue is a constrained resource leak and no unresolved Important-grade primitive remains. 5. One-sentence report phrase A Btrfs NOCOW direct I/O write error path can leak an extent_map reference when ordered extent allocation fails, allowing a local writer to cause gradual kernel resource exhaustion but not showing memory corruption or privilege escalation. 6. Manual review recommendation NO MANUAL CHECK NEEDED Reason: this is a concrete but constrained local reference leak with no UAF, no repeated release/refcount mutation, no C/I primitive, and no security-boundary bypass. 7. Call-site confidence Call-site confidence: high ====================================================================== UPSTREAM PATCH SUMMARY ====================================================================== Patch: btrfs: fix extent map leak in NOCOW direct I/O write Commit: f42efd634c0ae7ba0ce2fc5e30e291b0803b0ae2 Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f42efd634c0ae7ba0ce2fc5e30e291b0803b0ae2 Commit description: btrfs_dio_iomap_begin() calls btrfs_get_extent(), which returns an extent map reference that must be dropped on all exit paths. For direct writes into a NOCOW range, btrfs_get_blocks_direct_write() keeps using that extent map and asks btrfs_create_dio_extent() to allocate the ordered extent. If that fails, for example because btrfs_alloc_ordered_extent() fails, the function returns the error without dropping the input extent map. The PREALLOC path avoided this by dropping the input extent map before replacing it with the newly created one. Check the error from btrfs_create_dio_extent() before replacing the map and drop the input extent map on failure. Fixes: 5f9a8a5 ("Btrfs: add semaphore to synchronize direct IO writes with fsync") CC: stable@vger.kernel.org Reviewed-by: Qu Wenruo Reviewed-by: Filipe Manana Signed-off-by: Shuangpeng Bai Signed-off-by: Filipe Manana Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman Changed files: fs/btrfs/direct-io.c Diff excerpt: Not included in this email. See the upstream URL for the full patch. Full patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f42efd634c0ae7ba0ce2fc5e30e291b0803b0ae2 ====================================================================== DETAILED REPORT METHODOLOGY ====================================================================== The original Linux kernel CVE announcement for CVE-2026-89644 can be found here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89644 The original CVE announcement normally does not include a security-level estimate. In particular, it may not contain a CVSS assessment, an impact level, or enough information to determine whether the reported bug is a practically relevant security issue. One purpose of this parallel CVE list is to provide that missing technical and prioritization information. The original goal of the AL-KERNEL project was to prioritize Linux kernel CVE analysis automatically before manual review. The system can also help identify non-security issues that may be suitable for automatic closure. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. The first analysis stage combines an autonomous classifier with additional LLM-based analysis. The autonomous classifier runs locally on a CPU and is based on a backpropagation neural network. Together, these mechanisms produce a technical vulnerability description, identify likely weakness types, estimate CVSS severity, and provide input for ActionableScore. Two CVSS estimates are retained because incomplete kernel vulnerability information often permits more than one defensible interpretation: Conservative CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L The Best / paranoid CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H The Best / paranoid CVSS score: 4.7 The conservative vector represents a lower-impact interpretation. The Best/paranoid vector intentionally represents a plausible upper-bound interpretation and should not automatically be treated as demonstrated real-world impact. CVSS may also need to be adjusted for a particular Linux deployment, because actual reachability, privileges, enabled kernel configuration, hardware, namespaces, exposed device nodes, and other environmental conditions can differ significantly between systems. A separate ActionableScore mechanism evaluates practical remediation urgency. Its analysis may include reachability, attack prerequisites, subsystem exposure, memory-corruption characteristics, denial-of-service reliability, and possible confidentiality, integrity, or privilege-escalation impact. Conservative ActionableScore: unknown Paranoid ActionableScore: 2 The final base severity is taken directly from the second tab-separated field of the AL-KERNEL classification result. ActionableScore does not replace or independently override that final AL-KERNEL decision, and if ActionableScore adjusted impact level of ALKERNEL, then you would see self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7. For an AL-KERNEL result of MODERATE, this report uses the following additional presentation split: ActionableScore below 5 -> MODERATE REGULAR ActionableScore 5 or more -> MODERATE 7.0 The distinction between MODERATE REGULAR and MODERATE 7.0 makes it possible to identify Moderate issues that should receive manual analysis and fixes before lower-priority MODERATE REGULAR issues. In many cases, MODERATE REGULAR fixes may wait for a later rebase or routine update. There is one override in which MODERATE REGULAR becomes MODERATE 7.0 even when the ActionableScore is below 5. When the AL-KERNEL result contains the KPANIC flag, a MODERATE result is always presented as MODERATE 7.0. The KPANIC flag selected with few regexps without usage of AI at all, so it helps to detect cases when Kernel Crash happens and similar (to filter False-Negative results from the LLM usage). KPANIC indicates that a reliable kernel crash, kernel panic, or similarly serious kernel availability impact was identified by the classification workflow. AL-KERNEL base severity for this report: LOW KPANIC detected for this report: NO Published priority for this report (same as in Subject): LOW These results are intended to support engineering triage. They are machine-generated estimates, and cases marked for manual review should be validated by a human security engineer before final disposition. For more info read docs linked from here: https://kernelcve.org/ (and you can submit you own patch there to generate such a report for non-existant CVE-id yet). Note that in many cases this AI tool selects higher severity, than real is (means you can expect Importants instead of Moderate 7.0 or Moderates 7.0 instead of regular Moderates). If you see such cases, please use reply email interface to add additional manual analyses info to this particular CVE. And please, please, let me know when you see Lows instead of Importants or Important instead of Low (because particular for such cases I need to tune this AI tool to make it better for this one and next similar). My contact email for such notifications is alexanjelausa@gmail.com (and both send reply to CVE record itself too and see "reply" button below for howto reply).