CVE-2026-74722
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak in btrfs_do_encoded_write() Local fuzzing of 6.12.94 has found the following memory leak: Unreferenced object 0xffff888018050a80 (size 64): comm "syz.0.17", pid 10297, jiffies 4294953601 hex dump (first 32 bytes): 00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ 10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................ backtrace (crc a8a6fc29): kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] slab_post_alloc_hook mm/slub.c:4152 [inline] slab_alloc_node mm/slub.c:4197 [inline] __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358 kmalloc_noprof include/linux/slab.h:878 [inline] extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline] qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305 btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355 btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746 btrfs_encoded_write fs/btrfs/file.c:1482 [inline] btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507 btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738 btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x77/0x7f Unreferenced object 0xffff888018050a00 (size 64): comm "syz.0.17", pid 10297, jiffies 4294953601 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................ 90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................ backtrace (crc cb5c9580): kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] slab_post_alloc_hook mm/slub.c:4152 [inline] slab_alloc_node mm/slub.c:4197 [inline] __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114 extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline] __set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086 set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821 qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312 btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355 btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746 btrfs_encoded_write fs/btrfs/file.c:1482 [inline] btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507 btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738 btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fix this by freeing an extent changeset before returning from btrfs_do_encoded_write().
View original CVE JSON
{
"id": "CVE-2026-74722",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-08-22T16:16:47.183",
"lastModified": "2026-11-06T17:19:54.860",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix memory leak in btrfs_do_encoded_write()\n\nLocal fuzzing of 6.12.94 has found the following memory leak:\n\nUnreferenced object 0xffff888018050a80 (size 64):\n comm \"syz.0.17\", pid 10297, jiffies 4294953601\n hex dump (first 32 bytes):\n 00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................\n 10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................\n backtrace (crc a8a6fc29):\n kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\n slab_post_alloc_hook mm/slub.c:4152 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\n kmalloc_noprof include/linux/slab.h:878 [inline]\n extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline]\n qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305\n btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\n btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\n btrfs_encoded_write fs/btrfs/file.c:1482 [inline]\n btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\n btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\n btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:47 [inline]\n do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUnreferenced object 0xffff888018050a00 (size 64):\n comm \"syz.0.17\", pid 10297, jiffies 4294953601\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................\n 90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................\n backtrace (crc cb5c9580):\n kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\n slab_post_alloc_hook mm/slub.c:4152 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\n kmalloc_noprof include/linux/slab.h:878 [inline]\n kzalloc_noprof include/linux/slab.h:1014 [inline]\n ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114\n extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline]\n __set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086\n set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821\n qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312\n btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\n btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\n btrfs_encoded_write fs/btrfs/file.c:1482 [inline]\n btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\n btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\n btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:47 [inline]\n do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix this by freeing an extent changeset before returning from\nbtrfs_do_encoded_write()."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbtrfs: corregir fuga de memoria en btrfs_do_encoded_write()\n\nEl fuzzing local de 6.12.94 ha encontrado la siguiente fuga de memoria:\n\nObjeto sin referencia 0xffff888018050a80 (tamaño 64):\n comm 'syz.0.17', pid 10297, jiffies 4294953601\n volcado hexadecimal (primeros 32 bytes):\n 00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................\n 10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................\n rastreo (crc a8a6fc29):\n kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\n slab_post_alloc_hook mm/slub.c:4152 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\n kmalloc_noprof include/linux/slab.h:878 [inline]\n extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline]\n qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305\n btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\n btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\n btrfs_encoded_write fs/btrfs/file.c:1482 [inline]\n btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\n btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\n btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:47 [inline]\n do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nObjeto sin referencia 0xffff888018050a00 (tamaño 64):\n comm 'syz.0.17', pid 10297, jiffies 4294953601\n volcado hexadecimal (primeros 32 bytes):\n 00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................\n 90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................\n rastreo (crc cb5c9580):\n kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\n slab_post_alloc_hook mm/slub.c:4152 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\n kmalloc_noprof include/linux/slab.h:878 [inline]\n kzalloc_noprof include/linux/slab.h:1014 [inline]\n ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114\n extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline]\n __set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086\n set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821\n qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312\n btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\n btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\n btrfs_encoded_write fs/btrfs/file.c:1482 [inline]\n btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\n btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\n btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:47 [inline]\n do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCorregir esto liberando un extent changeset antes de regresar de btrfs_do_encoded_write()."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"fs/btrfs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22",
"lessThan": "0f0da96ccb1b9f35f4d3d4540dcaab0969d9d6b0",
"versionType": "git",
"status": "affected"
},
{
"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22",
"lessThan": "e2c7e88815edd5ecfb88e7660ab9fd42bda6bc47",
"versionType": "git",
"status": "affected"
},
{
"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22",
"lessThan": "20c0eeb4313f9f89d47b80b672b5846f9827cb31",
"versionType": "git",
"status": "affected"
},
{
"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22",
"lessThan": "24a8f2c29aebb753ccb962fbb25bae18d7978f6e",
"versionType": "git",
"status": "affected"
},
{
"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22",
"lessThan": "60b50ceba6243802f8d2c0a9a7c2d549a93b1d64",
"versionType": "git",
"status": "affected"
},
{
"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22",
"lessThan": "d2a4e4e626b2f4670b69b430c357f03f53eb6632",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"fs/btrfs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.18",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.18",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.183",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.152",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.104",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.45",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.9",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-06T17:01:38.012644Z",
"id": "CVE-2026-74722",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f0da96ccb1b9f35f4d3d4540dcaab0969d9d6b0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/20c0eeb4313f9f89d47b80b672b5846f9827cb31",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/24a8f2c29aebb753ccb962fbb25bae18d7978f6e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/60b50ceba6243802f8d2c0a9a7c2d549a93b1d64",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d2a4e4e626b2f4670b69b430c357f03f53eb6632",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e2c7e88815edd5ecfb88e7660ab9fd42bda6bc47",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}