{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.105-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix memory leak in btrfs_do_encoded_write()  Local fuzzing of 6.12.94 has found the following memory leak:  Unreferenced object 0xffff888018050a80 (size 64):   comm \"syz.0.17\", pid 10297, jiffies 4294953601   hex dump (first 32 bytes):     00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................     10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff  ................   backtrace (crc a8a6fc29):     kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]     slab_post_alloc_hook mm/slub.c:4152 [inline]     slab_alloc_node mm/slub.c:4197 [inline]     __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358     kmalloc_noprof include/linux/slab.h:878 [inline]     extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline]     qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305     btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355     btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746     btrfs_encoded_write fs/btrfs/file.c:1482 [inline]     btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507     btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738     btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1     vfs_ioctl fs/ioctl.c:51 [inline]     __do_sys_ioctl fs/ioctl.c:906 [inline]     __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892     do_syscall_x64 arch/x86/entry/common.c:47 [inline]     do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78     entry_SYSCALL_64_after_hwframe+0x77/0x7f  Unreferenced object 0xffff888018050a00 (size 64):   comm \"syz.0.17\", pid 10297, jiffies 4294953601   hex dump (first 32 bytes):     00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00  ................     90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff  ................   backtrace (crc cb5c9580):     kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]     slab_post_alloc_hook mm/slub.c:4152 [inline]     slab_alloc_node mm/slub.c:4197 [inline]     __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358     kmalloc_noprof include/linux/slab.h:878 [inline]     kzalloc_noprof include/linux/slab.h:1014 [inline]     ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114     extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline]     __set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086     set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821     qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312     btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355     btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746     btrfs_encoded_write fs/btrfs/file.c:1482 [inline]     btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507     btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738     btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1     vfs_ioctl fs/ioctl.c:51 [inline]     __do_sys_ioctl fs/ioctl.c:906 [inline]     __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892     do_syscall_x64 arch/x86/entry/common.c:47 [inline]     do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78     entry_SYSCALL_64_after_hwframe+0x77/0x7f  Fix this by freeing an extent changeset before returning from btrfs_do_encoded_write().",
  "id": "DEBIAN-CVE-2026-74722",
  "modified": "2026-09-19T21:47:24.587433429Z",
  "published": "2026-08-22T16:16:47.183Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-74722"
    }
  ],
  "upstream": [
    "CVE-2026-74722"
  ]
}