CVE-2026-89644

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix extent map leak in NOCOW direct I/O write

btrfs dio iomap begin() calls btrfs get extent(), which returns an extent map reference that must be dropped on all exit paths.

For direct writes into a NOCOW range, btrfs get blocks direct write() keeps using that extent map and asks btrfs create dio extent() to allocate the ordered extent. If that fails, for example because btrfs alloc ordered extent() fails, the function returns the error without dropping the input extent map. The PREALLOC path avoided this by dropping the input extent map before replacing it with the newly created one.

Check the error from btrfs create dio extent() before replacing the map and drop the input extent map on failure.