{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "36a580eb489f54d81a0534974962e732a314b999"
            },
            {
              "fixed": "39005fd1ce654ffdecacddc406b9a038efe606e6"
            },
            {
              "fixed": "bf49e6f6ddc12445a0330708b365de6458085980"
            },
            {
              "fixed": "4a1bb1f9f24a935c9b3f4fbf98012fa6d4ad826d"
            },
            {
              "fixed": "b313edfbc0c2a60f7ce09b2e81ee71909ab8ddaf"
            },
            {
              "fixed": "5d3783c451a546373662ee11ec17019273e68034"
            },
            {
              "fixed": "448636c745a3f3b8582a0b8ce718c890a11c0fa9"
            },
            {
              "fixed": "28362e8ce51377afdec1782e661e808328a10514"
            },
            {
              "fixed": "45662dedb8f272ef7f16e69f13424c4bd0399240"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.30"
            },
            {
              "fixed": "5.10.270"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.11.0"
            },
            {
              "fixed": "5.15.221"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.16.0"
            },
            {
              "fixed": "6.1.188"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.157"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.109"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.50"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89723.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation\n\nShuangpeng Bai reported that KASAN detected a slab-out-of-bounds error\nin nilfs_direct_propagate() during testing.\n\nAnalysis revealed that after truncating a file, a node block immediately\nbelow the B-tree root was not deleted.  Instead, it remained in the B-tree\nnode cache in a dirty state.  The log writer subsequently detected this\nblock and incorrectly invoked nilfs_direct_propagate() on it, which is\ndesigned to handle only data blocks in direct mapping.\n\nB-tree nodes in the cache are managed by virtual block numbers, and their\nlogical keys typically exceed the range expected by direct mapping.\nConsequently, processing such a node as a direct mapping entry triggers\na slab-out-of-bounds access.\n\nThe root cause is that when a B-tree mapping collapses into a direct\nmapping during truncation, an intermediate node block pointed to by the\nroot node is left behind as garbage instead of being explicitly deleted.\n\nThis resolves the issue by adding a nilfs_btree_discard() operation\nto delete the remaining intermediate node block during the conversion.\nA 'deform' flag is added to the bop_delete interface to explicitly signal\nthat the deletion is part of a mapping transformation.  This allows the\nB-tree mapping implementation to perform the necessary cleanup and\ndiscarding of the residual node structure that would be otherwise be left\norphaned after the transition.",
  "id": "CVE-2026-89723",
  "modified": "2026-09-15T03:31:06.421486057Z",
  "published": "2026-09-11T19:46:35.161Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/28362e8ce51377afdec1782e661e808328a10514"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/39005fd1ce654ffdecacddc406b9a038efe606e6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/448636c745a3f3b8582a0b8ce718c890a11c0fa9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/45662dedb8f272ef7f16e69f13424c4bd0399240"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4a1bb1f9f24a935c9b3f4fbf98012fa6d4ad826d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5d3783c451a546373662ee11ec17019273e68034"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b313edfbc0c2a60f7ce09b2e81ee71909ab8ddaf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bf49e6f6ddc12445a0330708b365de6458085980"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89723.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89723"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation"
}