Executive brief
The Linux kernel's Btrfs filesystem contains a memory leak in its direct I/O write handling. When writing directly to copy-on-write (NOCOW) regions, a reference to file extent metadata is not properly released if ordered extent allocation fails, causing memory to be held unnecessarily. While this is primarily a resource exhaustion issue, repeated failures could degrade system performance or availability.
Technical details
The vulnerability is a resource leak in the Btrfs filesystem's direct I/O code path. The function btrfs_dio_iomap_begin() obtains an extent map reference via btrfs_get_extent() that must be dropped on all exit paths. In btrfs_get_blocks_direct_write(), when handling NOCOW writes, if btrfs_create_dio_extent() fails (e.g., due to btrfs_alloc_ordered_extent() failure), the function returns without dropping the input extent map reference. The fix reorders error checking to drop the extent map immediately upon failure, before any map replacement occurs. This is a memory management bug affecting Linux kernel versions with NOCOW direct I/O support.
Affected products
- Linux Linux kernel 5.9.y and later with Btrfs NOCOW direct I/O support
Timeline
- 2026-09-11: disclosed: CVE published
- 2026-08-07: patched: Upstream fix in mainline (commit 3f950867c307)