CVE-2026-89772

A flaw was found in the Btrfs filesystem of the Linux kernel. This vulnerability allows a local attacker with write access to a memory-mapped file to modify data while it is being written to disk. This can lead to data corruption, where the integrity of the stored information is compromised, or data loss, where recent changes to a file are not saved correctly even after a save operation. The issue arises from a missing write-protection mechanism during specific data writeback operations.

A flaw was found in the Btrfs filesystem of the Linux kernel, rated moderate impact by Red Hat. Changes introduced in the upstream 6.13 kernel development cycle removed an early folio_clear_dirty_for_io() call during data writeback, which also dropped the folio_mkclean() call that write-protects shared memory-mapped page table entries. As a result, a local process that has a file memory-mapped with write access can modify a folio while the kernel is checksumming, compressing, copying, or writing it back, without triggering a page fault. This race condition can lead to data corruption (invalid checksums and corruption reports on subsequent reads) or to silent data loss, where writes present in the page cache are discarded when the folio's dirty bit is cleared, even if fsync() was called. The issue also affects zoned submissions, inline extents, folios spanning EOF, and compressed extents. Red Hat Enterprise Linux 7, 8, 9, and 10 are not affected because the vulnerable code, introduced upstream in the 6.13 kernel, is not present in the shipped Red Hat kernel versions, and OpenShift Container Platform 4 RHEL CoreOS builds that use those kernels are likewise not affected. OpenShift Container Platform 5.0 and 5.1 are affected; the fix is currently deferred for these streams and will be delivered through a future RHEL CoreOS kernel update. Until the fix is delivered, the residual risk remains that a local user with write access to a memory-mapped file on a Btrfs filesystem could trigger data corruption or data loss.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.