CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write()
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix memory leak in btrfsdoencodedwrite()
Local fuzzing of 6.12.94 has found the following memory leak:
Unreferenced object 0xffff888018050a80 (size 64): comm "syz.0.17", pid 10297, jiffies 4294953601 hex dump (first 32 bytes): 00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ 10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................ backtrace (crc a8a6fc29): kmemleakallocrecursive include/linux/kmemleak.h:42 [inline] slabpostallochook mm/slub.c:4152 [inline] slaballocnode mm/slub.c:4197 [inline] kmalloccachenoprof+0x168/0x2c0 mm/slub.c:4358 kmallocnoprof include/linux/slab.h:878 [inline] extentchangesetalloc fs/btrfs/extentio.h:207 [inline] qgroupreservedata+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305 btrfsqgroupreservedata+0x2e/0xb0 fs/btrfs/qgroup.c:4355 btrfsdoencodedwrite+0x92e/0x1040 fs/btrfs/inode.c:9746 btrfsencodedwrite fs/btrfs/file.c:1482 [inline] btrfsdowriteiter+0x280/0x610 fs/btrfs/file.c:1507 btrfsioctlencodedwrite+0x3d6/0x490 fs/btrfs/ioctl.c:4738 btrfsioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:906 [inline] sesysioctl+0xf9/0x170 fs/ioctl.c:892 dosyscallx64 arch/x86/entry/common.c:47 [inline] dosyscall64+0xbe/0x1a0 arch/x86/entry/common.c:78 entrySYSCALL64afterhwframe+0x77/0x7f
Unreferenced object 0xffff888018050a00 (size 64): comm "syz.0.17", pid 10297, jiffies 4294953601 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................ 90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................ backtrace (crc cb5c9580): kmemleakallocrecursive include/linux/kmemleak.h:42 [inline] slabpostallochook mm/slub.c:4152 [inline] slaballocnode mm/slub.c:4197 [inline] kmalloccachenoprof+0x168/0x2c0 mm/slub.c:4358 kmallocnoprof include/linux/slab.h:878 [inline] kzallocnoprof include/linux/slab.h:1014 [inline] ulistprealloc+0x9c/0x110 fs/btrfs/ulist.c:114 extentchangesetprealloc fs/btrfs/extentio.h:217 [inline] setextentbit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086 setrecordextentbits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821 qgroupreservedata+0x274/0x7d0 fs/btrfs/qgroup.c:4312 btrfsqgroupreservedata+0x2e/0xb0 fs/btrfs/qgroup.c:4355 btrfsdoencodedwrite+0x92e/0x1040 fs/btrfs/inode.c:9746 btrfsencodedwrite fs/btrfs/file.c:1482 [inline] btrfsdowriteiter+0x280/0x610 fs/btrfs/file.c:1507 btrfsioctlencodedwrite+0x3d6/0x490 fs/btrfs/ioctl.c:4738 btrfsioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:906 [inline] sesysioctl+0xf9/0x170 fs/ioctl.c:892 dosyscallx64 arch/x86/entry/common.c:47 [inline] dosyscall64+0xbe/0x1a0 arch/x86/entry/common.c:78 entrySYSCALL64afterhwframe+0x77/0x7f
Fix this by freeing an extent changeset before returning from btrfsdoencodedwrite().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 6.12.94 - Compensating control
If you run an affected btrfs kernel, consider limiting exposure to ioctls that can trigger btrfs_do_encoded_write memory leak until fixed kernels are deployed.
Event History
Frequently Asked Questions
What systems are exposed to this leak?
Systems using the Linux kernel with Btrfs are relevant. The reported path is the Btrfs encoded-write ioctl, and the leak occurs while reserving qgroup data during that operation.
What does an attacker or triggering process need to do?
The issue is triggered through an encoded write issued via the Btrfs ioctl interface. The report shows it was found through local fuzzing, so local access to perform operations against a Btrfs filesystem is implicated.
How can I determine whether the issue is occurring on a system?
The report identifies the leak through kmemleak and shows an allocation originating in extent_changeset_alloc, called from qgroup_reserve_data during btrfs_do_encoded_write. Inspecting kmemleak reports for this call chain can indicate that the leak has been triggered.