CVE-2026-89723

CVE-2026-89723 is a slab-out-of-bounds flaw in the Linux kernel's nilfs2 filesystem, reported via a KASAN-detected error in nilfs_direct_propagate(). When a file is truncated on a nilfs2 volume, the B-tree mapping can collapse into a direct mapping while leaving a residual intermediate node block in the node cache in a dirty state; the log writer later misidentifies this block as a direct-mapped data block and processes it, reading and writing past the bounds of the allocated slab object. A local, low-privileged user who can create and truncate files on a nilfs2 filesystem can trigger this kernel memory corruption, with CVSS 3.1 impact ratings of high for confidentiality, integrity, and availability (score 7.8) — in practice, at minimum a kernel crash and potentially worse memory-corruption consequences. Only systems running kernels that contain the vulnerable nilfs2 code AND actually mount/use nilfs2 filesystems are exposed, which is a small subset of Linux installations. No public proof of concept exists, and there is no evidence of exploitation in the wild; the issue is not on the CISA KEV list. The fix adds a nilfs_btree_discard() operation and a 'deform' flag to the bop_delete interface so the orphaned node block is explicitly deleted during the mapping transition.

What to do: Apply kernel updates from your distribution as soon as the nilfs2 fix (the commit adding nilfs_btree_discard() and the 'deform' flag to bop_delete) is backported. Inventory for exposure with 'lsblk -f', 'mount | grep nilfs2', or '/proc/filesystems' and prioritize patching any hosts with nilfs2 mounts. If nilfs2 is not used on a host, blacklist the module (e.g., an 'install nilfs2 /bin/false' line in modprobe.d) to close off the vulnerable code path; watch kernel logs for KASAN splats referencing nilfs_direct_propagate.