CVE-2026-74722

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74722", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.929Z", "datePublished": "2026-08-22T15:33:14.582Z", "dateUpdated": "2026-11-06T17:05:51.667Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:33:14.582Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix memory leak in btrfs_do_encoded_write()\n\nLocal fuzzing of 6.12.94 has found the following memory leak:\n\nUnreferenced object 0xffff888018050a80 (size 64):\n comm \"syz.0.17\", pid 10297, jiffies 4294953601\n hex dump (first 32 bytes):\n 00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................\n 10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................\n backtrace (crc a8a6fc29):\n kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\n slab_post_alloc_hook mm/slub.c:4152 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\n kmalloc_noprof include/linux/slab.h:878 [inline]\n extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline]\n qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305\n btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\n btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\n btrfs_encoded_write fs/btrfs/file.c:1482 [inline]\n btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\n btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\n btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:47 [inline]\n do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUnreferenced object 0xffff888018050a00 (size 64):\n comm \"syz.0.17\", pid 10297, jiffies 4294953601\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................\n 90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................\n backtrace (crc cb5c9580):\n kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\n slab_post_alloc_hook mm/slub.c:4152 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\n kmalloc_noprof include/linux/slab.h:878 [inline]\n kzalloc_noprof include/linux/slab.h:1014 [inline]\n ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114\n extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline]\n __set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086\n set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821\n qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312\n btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\n btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\n btrfs_encoded_write fs/btrfs/file.c:1482 [inline]\n btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\n btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\n btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:47 [inline]\n do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix this by freeing an extent changeset before returning from\nbtrfs_do_encoded_write()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/inode.c"], "versions": [{"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "lessThan": "0f0da96ccb1b9f35f4d3d4540dcaab0969d9d6b0", "status": "affected", "versionType": "git"}, {"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "lessThan": "e2c7e88815edd5ecfb88e7660ab9fd42bda6bc47", "status": "affected", "versionType": "git"}, {"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "lessThan": "20c0eeb4313f9f89d47b80b672b5846f9827cb31", "status": "affected", "versionType": "git"}, {"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "lessThan": "24a8f2c29aebb753ccb962fbb25bae18d7978f6e", "status": "affected", "versionType": "git"}, {"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "lessThan": "60b50ceba6243802f8d2c0a9a7c2d549a93b1d64", "status": "affected", "versionType": "git"}, {"version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "lessThan": "d2a4e4e626b2f4670b69b430c357f03f53eb6632", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/inode.c"], "versions": [{"version": "5.18", "status": "affected"}, {"version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0f0da96ccb1b9f35f4d3d4540dcaab0969d9d6b0"}, {"url": "https://git.kernel.org/stable/c/e2c7e88815edd5ecfb88e7660ab9fd42bda6bc47"}, {"url": "https://git.kernel.org/stable/c/20c0eeb4313f9f89d47b80b672b5846f9827cb31"}, {"url": "https://git.kernel.org/stable/c/24a8f2c29aebb753ccb962fbb25bae18d7978f6e"}, {"url": "https://git.kernel.org/stable/c/60b50ceba6243802f8d2c0a9a7c2d549a93b1d64"}, {"url": "https://git.kernel.org/stable/c/d2a4e4e626b2f4670b69b430c357f03f53eb6632"}], "title": "btrfs: fix memory leak in btrfs_do_encoded_write()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74722", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T17:01:38.012644Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:05:51.667Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74722", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T17:01:38.012644Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:01:39.851Z"}}], "cna": {"title": "btrfs: fix memory leak in btrfs_do_encoded_write()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "lessThan": "0f0da96ccb1b9f35f4d3d4540dcaab0969d9d6b0", "versionType": "git"}, {"status": "affected", "version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "lessThan": "e2c7e88815edd5ecfb88e7660ab9fd42bda6bc47", "versionType": "git"}, {"status": "affected", "version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "lessThan": "20c0eeb4313f9f89d47b80b672b5846f9827cb31", "versionType": "git"}, {"status": "affected", "version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "lessThan": "24a8f2c29aebb753ccb962fbb25bae18d7978f6e", "versionType": "git"}, {"status": "affected", "version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "lessThan": "60b50ceba6243802f8d2c0a9a7c2d549a93b1d64", "versionType": "git"}, {"status": "affected", "version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "lessThan": "d2a4e4e626b2f4670b69b430c357f03f53eb6632", "versionType": "git"}], "programFiles": ["fs/btrfs/inode.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"status": "unaffected", "version": "0", "lessThan": "5.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/btrfs/inode.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0f0da96ccb1b9f35f4d3d4540dcaab0969d9d6b0"}, {"url": "https://git.kernel.org/stable/c/e2c7e88815edd5ecfb88e7660ab9fd42bda6bc47"}, {"url": "https://git.kernel.org/stable/c/20c0eeb4313f9f89d47b80b672b5846f9827cb31"}, {"url": "https://git.kernel.org/stable/c/24a8f2c29aebb753ccb962fbb25bae18d7978f6e"}, {"url": "https://git.kernel.org/stable/c/60b50ceba6243802f8d2c0a9a7c2d549a93b1d64"}, {"url": "https://git.kernel.org/stable/c/d2a4e4e626b2f4670b69b430c357f03f53eb6632"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix memory leak in btrfs_do_encoded_write()\n\nLocal fuzzing of 6.12.94 has found the following memory leak:\n\nUnreferenced object 0xffff888018050a80 (size 64):\n comm \"syz.0.17\", pid 10297, jiffies 4294953601\n hex dump (first 32 bytes):\n 00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................\n 10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................\n backtrace (crc a8a6fc29):\n kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\n slab_post_alloc_hook mm/slub.c:4152 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\n kmalloc_noprof include/linux/slab.h:878 [inline]\n extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline]\n qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305\n btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\n btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\n btrfs_encoded_write fs/btrfs/file.c:1482 [inline]\n btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\n btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\n btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:47 [inline]\n do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUnreferenced object 0xffff888018050a00 (size 64):\n comm \"syz.0.17\", pid 10297, jiffies 4294953601\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................\n 90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................\n backtrace (crc cb5c9580):\n kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\n slab_post_alloc_hook mm/slub.c:4152 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\n kmalloc_noprof include/linux/slab.h:878 [inline]\n kzalloc_noprof include/linux/slab.h:1014 [inline]\n ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114\n extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline]\n __set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086\n set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821\n qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312\n btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\n btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\n btrfs_encoded_write fs/btrfs/file.c:1482 [inline]\n btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\n btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\n btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:47 [inline]\n do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix this by freeing an extent changeset before returning from\nbtrfs_do_encoded_write()."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.18"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:33:14.582Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74722", "state": "PUBLISHED", "dateUpdated": "2026-11-06T17:05:51.667Z", "dateReserved": "2026-08-15T05:44:03.929Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:33:14.582Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/btrfs/inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0f0da96ccb1b9f35f4d3d4540dcaab0969d9d6b0", "status": "affected", "version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "versionType": "git"}, {"lessThan": "e2c7e88815edd5ecfb88e7660ab9fd42bda6bc47", "status": "affected", "version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "versionType": "git"}, {"lessThan": "20c0eeb4313f9f89d47b80b672b5846f9827cb31", "status": "affected", "version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "versionType": "git"}, {"lessThan": "24a8f2c29aebb753ccb962fbb25bae18d7978f6e", "status": "affected", "version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "versionType": "git"}, {"lessThan": "60b50ceba6243802f8d2c0a9a7c2d549a93b1d64", "status": "affected", "version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "versionType": "git"}, {"lessThan": "d2a4e4e626b2f4670b69b430c357f03f53eb6632", "status": "affected", "version": "7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/btrfs/inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"lessThan": "5.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix memory leak in btrfs_do_encoded_write()\n\nLocal fuzzing of 6.12.94 has found the following memory leak:\n\nUnreferenced object 0xffff888018050a80 (size 64):\n comm \"syz.0.17\", pid 10297, jiffies 4294953601\n hex dump (first 32 bytes):\n 00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................\n 10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................\n backtrace (crc a8a6fc29):\n kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\n slab_post_alloc_hook mm/slub.c:4152 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\n kmalloc_noprof include/linux/slab.h:878 [inline]\n extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline]\n qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305\n btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\n btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\n btrfs_encoded_write fs/btrfs/file.c:1482 [inline]\n btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\n btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\n btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:47 [inline]\n do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUnreferenced object 0xffff888018050a00 (size 64):\n comm \"syz.0.17\", pid 10297, jiffies 4294953601\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................\n 90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................\n backtrace (crc cb5c9580):\n kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\n slab_post_alloc_hook mm/slub.c:4152 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\n kmalloc_noprof include/linux/slab.h:878 [inline]\n kzalloc_noprof include/linux/slab.h:1014 [inline]\n ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114\n extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline]\n __set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086\n set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821\n qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312\n btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\n btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\n btrfs_encoded_write fs/btrfs/file.c:1482 [inline]\n btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\n btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\n btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:47 [inline]\n do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix this by freeing an extent changeset before returning from\nbtrfs_do_encoded_write()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbtrfs: corregir fuga de memoria en btrfs_do_encoded_write()\n\nEl fuzzing local de 6.12.94 ha encontrado la siguiente fuga de memoria:\n\nObjeto sin referencia 0xffff888018050a80 (tama\u00f1o 64):\n comm 'syz.0.17', pid 10297, jiffies 4294953601\n volcado hexadecimal (primeros 32 bytes):\n 00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................\n 10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................\n rastreo (crc a8a6fc29):\n kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\n slab_post_alloc_hook mm/slub.c:4152 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\n kmalloc_noprof include/linux/slab.h:878 [inline]\n extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline]\n qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305\n btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\n btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\n btrfs_encoded_write fs/btrfs/file.c:1482 [inline]\n btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\n btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\n btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:47 [inline]\n do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nObjeto sin referencia 0xffff888018050a00 (tama\u00f1o 64):\n comm 'syz.0.17', pid 10297, jiffies 4294953601\n volcado hexadecimal (primeros 32 bytes):\n 00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................\n 90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................\n rastreo (crc cb5c9580):\n kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\n slab_post_alloc_hook mm/slub.c:4152 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\n kmalloc_noprof include/linux/slab.h:878 [inline]\n kzalloc_noprof include/linux/slab.h:1014 [inline]\n ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114\n extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline]\n __set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086\n set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821\n qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312\n btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\n btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\n btrfs_encoded_write fs/btrfs/file.c:1482 [inline]\n btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\n btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\n btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:47 [inline]\n do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCorregir esto liberando un extent changeset antes de regresar de btrfs_do_encoded_write()."}], "id": "CVE-2026-74722", "lastModified": "2026-11-06T17:19:54.860", "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74722", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T17:01:38.012644Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:47.183", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f0da96ccb1b9f35f4d3d4540dcaab0969d9d6b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/20c0eeb4313f9f89d47b80b672b5846f9827cb31"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/24a8f2c29aebb753ccb962fbb25bae18d7978f6e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/60b50ceba6243802f8d2c0a9a7c2d549a93b1d64"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d2a4e4e626b2f4670b69b430c357f03f53eb6632"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e2c7e88815edd5ecfb88e7660ab9fd42bda6bc47"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: btrfs: fix memory leak in btrfs_do_encoded_write()", "id": "2521445", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521445"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbtrfs: fix memory leak in btrfs_do_encoded_write()\nLocal fuzzing of 6.12.94 has found the following memory leak:\nUnreferenced object 0xffff888018050a80 (size 64):\ncomm \"syz.0.17\", pid 10297, jiffies 4294953601\nhex dump (first 32 bytes):\n00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................\n10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................\nbacktrace (crc a8a6fc29):\nkmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\nslab_post_alloc_hook mm/slub.c:4152 [inline]\nslab_alloc_node mm/slub.c:4197 [inline]\n__kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\nkmalloc_noprof include/linux/slab.h:878 [inline]\nextent_changeset_alloc fs/btrfs/extent_io.h:207 [inline]\nqgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305\nbtrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\nbtrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\nbtrfs_encoded_write fs/btrfs/file.c:1482 [inline]\nbtrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\nbtrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\nbtrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\nvfs_ioctl fs/ioctl.c:51 [inline]\n__do_sys_ioctl fs/ioctl.c:906 [inline]\n__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\ndo_syscall_x64 arch/x86/entry/common.c:47 [inline]\ndo_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\nUnreferenced object 0xffff888018050a00 (size 64):\ncomm \"syz.0.17\", pid 10297, jiffies 4294953601\nhex dump (first 32 bytes):\n00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................\n90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................\nbacktrace (crc cb5c9580):\nkmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]\nslab_post_alloc_hook mm/slub.c:4152 [inline]\nslab_alloc_node mm/slub.c:4197 [inline]\n__kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358\nkmalloc_noprof include/linux/slab.h:878 [inline]\nkzalloc_noprof include/linux/slab.h:1014 [inline]\nulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114\nextent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline]\n__set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086\nset_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821\nqgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312\nbtrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355\nbtrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746\nbtrfs_encoded_write fs/btrfs/file.c:1482 [inline]\nbtrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507\nbtrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738\nbtrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1\nvfs_ioctl fs/ioctl.c:51 [inline]\n__do_sys_ioctl fs/ioctl.c:906 [inline]\n__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892\ndo_syscall_x64 arch/x86/entry/common.c:47 [inline]\ndo_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\nFix this by freeing an extent changeset before returning from\nbtrfs_do_encoded_write().", "A flaw was found in the Linux kernel's btrfs filesystem. A local attacker could exploit a memory leak in the `btrfs_do_encoded_write()` function. This occurs because an extent changeset is not properly freed before the function returns. Successful exploitation of this memory leak could lead to a denial of service (DoS) due to memory exhaustion."], "name": "CVE-2026-74722", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74722\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74722\nhttps://lore.kernel.org/linux-cve-announce/2026082240-CVE-2026-74722-c4c2@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22,0f0da96ccb1b9f35f4d3d4540dcaab0969d9d6b0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22,e2c7e88815edd5ecfb88e7660ab9fd42bda6bc47)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22,20c0eeb4313f9f89d47b80b672b5846f9827cb31)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22,24a8f2c29aebb753ccb962fbb25bae18d7978f6e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22,60b50ceba6243802f8d2c0a9a7c2d549a93b1d64)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7c0c7269f7b508ba6e4b063a9314d6bd1fb6db22,d2a4e4e626b2f4670b69b430c357f03f53eb6632)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T18:00:04.732902+00:00", "updated": "2026-08-25T17:45:04.931135+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}