CVE-2026-89644

What it actually does

Failure to drop an extent map reference returned by btrfs_get_extent() on error paths in btrfs_dio_iomap_begin() during NOCOW direct writes when btrfs_create_dio_extent() fails, resulting in a kernel memory leak.

Why it matters to the business

Repeated triggering of the flawed code path can exhaust kernel memory on systems using the btrfs filesystem for direct I/O, leading to degraded performance, instability, or denial of service; the low EPSS and absence from KEV indicate limited active exploitation risk but still requires timely patching on affected Linux kernels.

How an attack unfolds

An attacker with local access crafts direct I/O write operations targeting NOCOW extents in btrfs, forcing allocation failures in btrfs_alloc_ordered_extent() after the extent map is obtained but before it is released, accumulating unreleased references until memory pressure occurs.

How to fix it

Update to a Linux kernel containing the fix for the extent map leak in btrfs NOCOW direct I/O handling; apply the patch that checks the return value of btrfs_create_dio_extent() and releases the input extent map on failure.

How to confirm the fix worked

Confirm the presence of the corrected error-handling logic around btrfs_create_dio_extent() in btrfs_dio_iomap_begin() and btrfs_get_blocks_direct_write(); test direct I/O writes under failure injection to verify no extent map leaks occur.

Typical attack path

1. Obtain local unprivileged access to a system using btrfs
2. Issue repeated direct I/O writes into NOCOW file ranges
3. Induce failures in ordered extent allocation to leak extent maps
4. Repeat until kernel memory is exhausted

How to detect it

Review kernel memory accounting and slab usage for excessive extent map allocations; examine audit logs or syscall traces for patterns of direct I/O writes to NOCOW files accompanied by allocation errors.

What your security team should do

• Prioritize kernel updates for any systems running btrfs with direct I/O workloads
• Monitor memory usage on btrfs hosts for unexplained growth
• Apply the fix within standard patch cycles given the low EPSS score