CVE-2026-89965

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write exists in the BTT info block because the nfree field, representing the number of reserve free blocks, is read from the medium without validation. The functions btt freelist init() and btt rtt init() size the per-lane freelist[] and rtt[] arrays based on nfree. However, the I/O path indexes these arrays using a lane from nd region acquire lane(), which is bounded by nd region->num lanes (ND MAX LANES) rather than nfree. A crafted or foreign arena with an nfree value lower than the lane count can cause the freelist[lane] or rtt[lane] access to exceed the allocated memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.