CVE-2026-89772

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: write-protect folios during data writeback

commit 095be159f3eb ("btrfs: unify folio dirty flag clearing") replaced

the folio_clear_dirty_for_io() call in extent_write_cache_pages() with a

plain folio_test_dirty() check. Besides clearing the dirty flag,

folio_clear_dirty_for_io() also calls folio_mkclean(), which write-protects

the shared mmap PTEs mapping the folio. Note that we still do call

folio_clear_dirty_for_io() later in submit_one_sector() when we clear

dirty on the last sector of the folio (the only sector for non-subpage

cases). But we lost this early call in extent_write_cache_pages().

Without the extra write-protection, a process with the file mmap-ed can

modify a sector while it is being used by writeback in a way that

expects a stable folio (checksumming, compressing, copying, etc...)

without faulting, which manifests as a handful of concrete bugs.

1. For large folios or subpage sectorsize, it

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References