{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89772 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89772 is a vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89772 and fix it if it is affected.\n\nWhat it is: CVE-2026-89772 is a vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89772 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89772/ (Markdown: https://insights.sbomify.com/CVE-2026-89772/index.md)","id":"CVE-2026-89772","markdown":"https://insights.sbomify.com/CVE-2026-89772/index.md","name":"CVE-2026-89772","record":{"aliases":["BELL-CVE-2026-89772","DEBIAN-CVE-2026-89772","GHSA-xrh7-4f5f-76f9","UBUNTU-CVE-2026-89772"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_modify","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel filesystem","requires_auth":"low_privilege","summary":"A race condition in btrfs writeback allows local attackers to corrupt data or cause filesystem inconsistencies by modifying mmap-ed files during checksumming.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: write-protect folios during data writeback\n\ncommit 095be159f3eb (\"btrfs: unify folio dirty flag clearing\") replaced\nthe folio_clear_dirty_for_io() call in extent_write_cache_pages() with a\nplain folio_test_dirty() check. Besides clearing the dirty flag,\nfolio_clear_dirty_for_io() also calls folio_mkclean(), which write-protects\nthe shared mmap PTEs mapping the folio. Note that we still do call\nfolio_clear_dirty_for_io() later in submit_one_sector() when we clear\ndirty on the last sector of the folio (the only sector for non-subpage\ncases). But we lost this early call in extent_write_cache_pages().\n\nWithout the extra write-protection, a process with the file mmap-ed can\nmodify a sector while it is being used by writeback in a way that\nexpects a stable folio (checksumming, compressing, copying, etc...)\nwithout faulting, which manifests as a handful of concrete bugs.\n\n1. For large folios or subpage sectorsize, it is possible to submit a bio\nwhich does not cover the whole folio. When this happens, we will have a\nbio in flight for a folio that we have *not* called\nfolio_clear_dirty_for_io() on. If a task with an existing mmap-ed PTE\nwrites (without faulting..) in this window, it can result in\ncorruptions. If the write arrives while the checksumming or writing itself\nis underway, this can result in an invalid checksum and later corruption\nreports on read. If the write arrives after checksumming/writing is done\nbut before the last sector dirty is cleared, then the write is present\nin page cache but doesn't affect the dirty tracking and will be lost\nwhen the folio is fully finished being submitted and the dirty bit\nis cleared. This results in losing the write even if fsync() is called.\n\n2. For zoned submissions which are done in batch separate from the main\nextent_writepage() loop, we also risk csum violations for those\nsubmissions. Zoned writes are clamped to max_zone_append_size and are\nnot aligned with folios, so a submission can span two folios. The first\nfolio being processed in extent_write_cache_pages() will call\nextent_write_locked_range() which will submit the partial range of the\nnext folio, while the rest of that folio could still be dirty. So\nclearing dirty on the submitted sectors doesn't call\nfolio_clear_dirty_for_io() and we have the same issue. Since\nextent_write_cache_pages() skips these batch submitted folios (they are\nalready marked for writeback from submission by the preceding folio), we\nmust add the extra write protection in lock_delalloc_folios().\n\n3. For inline extents this will subtly risk losing writes that happen\nafter/while we copy the inline extent but before we clear dirty on\nthe folio.\n\n4. For folios spanning EOF, mmap could tamper with the zeroed bytes past\nEOF and cause them to be persisted where future faults would improperly\nsee them instead of zeros.\n\n5. Finally, for compressed extents, we risk modifying the folios while we\nwork on compressing them which will result in corrupted compressed data.\nSpecifically, in run_delalloc_compressed() we queue up work to do\ncompress_file_range() in BTRFS_COMPRESSION_CHUNK_SIZE (512K) chunks which\nwill call btrfs_folio_clamp_clear_dirty() on the range. For non-subpage,\nthis will always clear the whole folio, safely. For subpage, we risk a\npartial clear here as well. In particular, imagine a 2M folio broken up\ninto 512K chunks of work which might start compression work on one chunk\nbefore all the chunks compress_file_range() workers have gotten far\nenough to finish clearing all the dirty bitmaps of the folio and getting\nto folio_clear_dirty_for_io(). Large folios on the edges of submission\nranges are similarly at risk to be only partly cleared.\nThis particular gap was introduced by a second patch in the same series:\ncommit a4ef54dbb576 (\"btrfs: make extent_range_clear_dirty_for_io() to handle sector size \u003c page size cases\")\n\nWe cannot simply restore the call to folio_clear\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"btrfs: write-protect folios during data writeback","id":"CVE-2026-89772","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"drm/amd/display: Skip Update HDCP Config In Transition State","id":"CVE-2026-89773"},"packages":[],"prev":{"headline":"ring-buffer: Fix subbuf resize race with ring buffer readers","id":"CVE-2026-89771"},"products":["Linux"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A race condition in btrfs writeback allows local attackers to corrupt data or cause filesystem inconsistencies by modifying mmap-ed files during checksumming.","url":"https://insights.sbomify.com/CVE-2026-89772/"}