GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-89772

Vulnerability from fkie_nvd - Published: 2026-09-11 20:20 - Updated: 2026-09-11 20:20
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb ("btrfs: unify folio dirty flag clearing") replaced the folio_clear_dirty_for_io() call in extent_write_cache_pages() with a plain folio_test_dirty() check. Besides clearing the dirty flag, folio_clear_dirty_for_io() also calls folio_mkclean(), which write-protects the shared mmap PTEs mapping the folio. Note that we still do call folio_clear_dirty_for_io() later in submit_one_sector() when we clear dirty on the last sector of the folio (the only sector for non-subpage cases). But we lost this early call in extent_write_cache_pages(). Without the extra write-protection, a process with the file mmap-ed can modify a sector while it is being used by writeback in a way that expects a stable folio (checksumming, compressing, copying, etc...) without faulting, which manifests as a handful of concrete bugs. 1. For large folios or subpage sectorsize, it is possible to submit a bio which does not cover the whole folio. When this happens, we will have a bio in flight for a folio that we have *not* called folio_clear_dirty_for_io() on. If a task with an existing mmap-ed PTE writes (without faulting..) in this window, it can result in corruptions. If the write arrives while the checksumming or writing itself is underway, this can result in an invalid checksum and later corruption reports on read. If the write arrives after checksumming/writing is done but before the last sector dirty is cleared, then the write is present in page cache but doesn't affect the dirty tracking and will be lost when the folio is fully finished being submitted and the dirty bit is cleared. This results in losing the write even if fsync() is called. 2. For zoned submissions which are done in batch separate from the main extent_writepage() loop, we also risk csum violations for those submissions. Zoned writes are clamped to max_zone_append_size and are not aligned with folios, so a submission can span two folios. The first folio being processed in extent_write_cache_pages() will call extent_write_locked_range() which will submit the partial range of the next folio, while the rest of that folio could still be dirty. So clearing dirty on the submitted sectors doesn't call folio_clear_dirty_for_io() and we have the same issue. Since extent_write_cache_pages() skips these batch submitted folios (they are already marked for writeback from submission by the preceding folio), we must add the extra write protection in lock_delalloc_folios(). 3. For inline extents this will subtly risk losing writes that happen after/while we copy the inline extent but before we clear dirty on the folio. 4. For folios spanning EOF, mmap could tamper with the zeroed bytes past EOF and cause them to be persisted where future faults would improperly see them instead of zeros. 5. Finally, for compressed extents, we risk modifying the folios while we work on compressing them which will result in corrupted compressed data. Specifically, in run_delalloc_compressed() we queue up work to do compress_file_range() in BTRFS_COMPRESSION_CHUNK_SIZE (512K) chunks which will call btrfs_folio_clamp_clear_dirty() on the range. For non-subpage, this will always clear the whole folio, safely. For subpage, we risk a partial clear here as well. In particular, imagine a 2M folio broken up into 512K chunks of work which might start compression work on one chunk before all the chunks compress_file_range() workers have gotten far enough to finish clearing all the dirty bitmaps of the folio and getting to folio_clear_dirty_for_io(). Large folios on the edges of submission ranges are similarly at risk to be only partly cleared. This particular gap was introduced by a second patch in the same series: commit a4ef54dbb576 ("btrfs: make extent_range_clear_dirty_for_io() to handle sector size < page size cases") We cannot simply restore the call to folio_clear ---truncated---
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/074c715e0b498891c09fe7f11e1cd9d7a04699bd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5376c9db45368eb210b4d71104ac00a59dc8b6e0
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/extent_io.c",
            "fs/btrfs/extent_io.h",
            "fs/btrfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "074c715e0b498891c09fe7f11e1cd9d7a04699bd",
              "status": "affected",
              "version": "a4ef54dbb576032ba31a646a5ffc8a26a83cb92c",
              "versionType": "git"
            },
            {
              "lessThan": "5376c9db45368eb210b4d71104ac00a59dc8b6e0",
              "status": "affected",
              "version": "a4ef54dbb576032ba31a646a5ffc8a26a83cb92c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/extent_io.c",
            "fs/btrfs/extent_io.h",
            "fs/btrfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: write-protect folios during data writeback\n\ncommit 095be159f3eb (\"btrfs: unify folio dirty flag clearing\") replaced\nthe folio_clear_dirty_for_io() call in extent_write_cache_pages() with a\nplain folio_test_dirty() check. Besides clearing the dirty flag,\nfolio_clear_dirty_for_io() also calls folio_mkclean(), which write-protects\nthe shared mmap PTEs mapping the folio. Note that we still do call\nfolio_clear_dirty_for_io() later in submit_one_sector() when we clear\ndirty on the last sector of the folio (the only sector for non-subpage\ncases). But we lost this early call in extent_write_cache_pages().\n\nWithout the extra write-protection, a process with the file mmap-ed can\nmodify a sector while it is being used by writeback in a way that\nexpects a stable folio (checksumming, compressing, copying, etc...)\nwithout faulting, which manifests as a handful of concrete bugs.\n\n1. For large folios or subpage sectorsize, it is possible to submit a bio\nwhich does not cover the whole folio. When this happens, we will have a\nbio in flight for a folio that we have *not* called\nfolio_clear_dirty_for_io() on. If a task with an existing mmap-ed PTE\nwrites (without faulting..) in this window, it can result in\ncorruptions. If the write arrives while the checksumming or writing itself\nis underway, this can result in an invalid checksum and later corruption\nreports on read. If the write arrives after checksumming/writing is done\nbut before the last sector dirty is cleared, then the write is present\nin page cache but doesn\u0027t affect the dirty tracking and will be lost\nwhen the folio is fully finished being submitted and the dirty bit\nis cleared. This results in losing the write even if fsync() is called.\n\n2. For zoned submissions which are done in batch separate from the main\nextent_writepage() loop, we also risk csum violations for those\nsubmissions. Zoned writes are clamped to max_zone_append_size and are\nnot aligned with folios, so a submission can span two folios. The first\nfolio being processed in extent_write_cache_pages() will call\nextent_write_locked_range() which will submit the partial range of the\nnext folio, while the rest of that folio could still be dirty. So\nclearing dirty on the submitted sectors doesn\u0027t call\nfolio_clear_dirty_for_io() and we have the same issue. Since\nextent_write_cache_pages() skips these batch submitted folios (they are\nalready marked for writeback from submission by the preceding folio), we\nmust add the extra write protection in lock_delalloc_folios().\n\n3. For inline extents this will subtly risk losing writes that happen\nafter/while we copy the inline extent but before we clear dirty on\nthe folio.\n\n4. For folios spanning EOF, mmap could tamper with the zeroed bytes past\nEOF and cause them to be persisted where future faults would improperly\nsee them instead of zeros.\n\n5. Finally, for compressed extents, we risk modifying the folios while we\nwork on compressing them which will result in corrupted compressed data.\nSpecifically, in run_delalloc_compressed() we queue up work to do\ncompress_file_range() in BTRFS_COMPRESSION_CHUNK_SIZE (512K) chunks which\nwill call btrfs_folio_clamp_clear_dirty() on the range. For non-subpage,\nthis will always clear the whole folio, safely. For subpage, we risk a\npartial clear here as well. In particular, imagine a 2M folio broken up\ninto 512K chunks of work which might start compression work on one chunk\nbefore all the chunks compress_file_range() workers have gotten far\nenough to finish clearing all the dirty bitmaps of the folio and getting\nto folio_clear_dirty_for_io(). Large folios on the edges of submission\nranges are similarly at risk to be only partly cleared.\nThis particular gap was introduced by a second patch in the same series:\ncommit a4ef54dbb576 (\"btrfs: make extent_range_clear_dirty_for_io() to handle sector size \u003c page size cases\")\n\nWe cannot simply restore the call to folio_clear\n---truncated---"
    }
  ],
  "id": "CVE-2026-89772",
  "lastModified": "2026-09-11T20:20:08.577",
  "metrics": {},
  "published": "2026-09-11T20:20:08.577",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/074c715e0b498891c09fe7f11e1cd9d7a04699bd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5376c9db45368eb210b4d71104ac00a59dc8b6e0"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.