CVE-2026-74722: Linux Kernel Btrfs Use-After-Free Vulnerability

CVE-2026-74722 Overview

CVE-2026-74722 is a memory leak vulnerability in the Linux kernel's Btrfs filesystem. The flaw resides in btrfs_do_encoded_write() at fs/btrfs/inode.c:9746, where an extent changeset allocated during btrfs_qgroup_reserve_data() is not freed on certain return paths. Local fuzzing of kernel version 6.12.94 identified the leak through kmemleak reports. Repeated invocation of the affected ioctl path exhausts kernel slab memory over time, degrading system stability. The vulnerability was discovered through syzkaller-style local fuzzing and has been resolved in mainline and stable kernels.

Critical Impact
Local users invoking the encoded write ioctl on Btrfs volumes can trigger repeated kernel memory leaks, leading to resource exhaustion and potential denial of service on long-running systems.

Affected Products

Linux kernel Btrfs filesystem (confirmed on 6.12.94)
Distributions shipping affected stable kernel branches prior to the referenced fix commits
Systems that expose the BTRFS_IOC_ENCODED_WRITEioctl to local users

Discovery Timeline

2026-08-22 - CVE-2026-74722 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74722

Vulnerability Analysis

The vulnerability is a memory leak [CWE-401] in the Btrfs encoded write path. When a userspace process issues the encoded write ioctl, execution reaches btrfs_do_encoded_write() in fs/btrfs/inode.c. This function calls btrfs_qgroup_reserve_data(), which in turn invokes qgroup_reserve_data() at fs/btrfs/qgroup.c:4305.

During reservation, extent_changeset_alloc() allocates a 64-byte tracking structure via kmalloc. A subsequent call to ulist_prealloc() at fs/btrfs/ulist.c:114 allocates an additional 64-byte node through kzalloc for the extent I/O tree bookkeeping. Both allocations are attached to the extent changeset.

On certain return paths from btrfs_do_encoded_write(), the function fails to release the extent changeset before returning. The associated slab objects are never freed and remain unreferenced, as confirmed by kmemleak backtraces originating from __kmalloc_cache_noprof and slab_post_alloc_hook.

Root Cause

The root cause is missing cleanup of an extent_changeset structure in btrfs_do_encoded_write(). The function acquires reservation state through btrfs_qgroup_reserve_data() but does not consistently free the allocated changeset on all exit paths. Each leaked changeset carries a nested ulist allocation, compounding the memory loss per invocation.

Attack Vector

Exploitation requires local access and the ability to issue the BTRFS_IOC_ENCODED_WRITEioctl against a Btrfs-mounted filesystem. An unprivileged user or automated workload that repeatedly triggers encoded writes can steadily consume unreclaimable kernel slab memory. This is not a remote or privilege escalation vector; the practical impact is denial of service through kernel memory exhaustion on hosts that expose the ioctl to untrusted local principals or long-running fuzzing and stress workloads.

The vulnerability was surfaced by local fuzzing tooling that repeatedly invoked __se_sys_ioctl -> btrfs_ioctl -> btrfs_ioctl_encoded_write -> btrfs_do_write_iter -> btrfs_encoded_write -> btrfs_do_encoded_write. See the kernel patch commits referenced below for the exact fix.

// No verified exploit code is available for CVE-2026-74722.
// See kernel patch commits for the corrective diff.

Detection Methods for CVE-2026-74722

Indicators of Compromise

Kmemleak reports referencing extent_changeset_alloc and ulist_prealloc in the backtrace, originating from btrfs_do_encoded_write.
Growth of the kmalloc-64 slab cache in /proc/slabinfo on hosts running Btrfs workloads.
Repeated ioctl syscalls with the BTRFS_IOC_ENCODED_WRITE command from unexpected processes.

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test kernels and correlate leak reports against the call chain btrfs_do_encoded_write -> btrfs_qgroup_reserve_data.
Baseline slab allocator metrics with slabtop and alert on sustained growth of kmalloc-64 without corresponding filesystem workload changes.
Monitor ioctl audit events for the encoded write command code on production Btrfs hosts.

Monitoring Recommendations

Ingest kernel logs and dmesg output into a centralized log platform and search for kmemleak entries referencing btrfs.
Track kernel memory pressure indicators such as MemAvailable, Slab, and SReclaimable and alert on abnormal drift.
Audit which local users and containers can issue ioctl calls against Btrfs mounts and review syscall telemetry for unexpected callers.

How to Mitigate CVE-2026-74722

Immediate Actions Required

Apply the upstream Btrfs fix that frees the extent changeset before returning from btrfs_do_encoded_write().
Upgrade to a stable kernel release that includes the referenced fix commits from git.kernel.org.
Restrict local access to Btrfs volumes and reduce the population of users permitted to run untrusted code on affected hosts.

Patch Information

The fix has been merged across multiple stable branches. Reference commits: Kernel Patch 0f0da96c, Kernel Patch 20c0eeb4, Kernel Patch 24a8f2c2, Kernel Patch 60b50ceb, Kernel Patch d2a4e4e6, and Kernel Patch e2c7e888. The corrective change frees the extent changeset before returning from btrfs_do_encoded_write().

Workarounds

Where feasible, avoid granting local users write access to Btrfs filesystems until patches are deployed.
Use container and seccomp policies to block the BTRFS_IOC_ENCODED_WRITEioctl for untrusted workloads.
Schedule regular reboots on long-running hosts to reclaim leaked kernel memory until a patched kernel is installed.

bash

# Example: block the encoded write ioctl with a seccomp filter allowlist,
# or restrict Btrfs mounts to trusted users via mount namespaces and ACLs.
chmod o-w /mnt/btrfs-volume