# CVE-2026-74722 — Linux > As of 2026-08-22, CVE-2026-74722 is a vulnerability in Linux, EPSS 0.2% (12.1th percentile). No Threadlinqs-tracked threat campaign has been attributed to CVE-2026-74722 as of 2026-08-22; the identifier is re-checked against the Threadlinqs threat corpus on every daily ingest. **Last updated:** 2026-08-22 ## What is CVE-2026-74722? In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak in btrfs_do_encoded_write() Local fuzzing of 6.12.94 has found the following memory leak: Unreferenced object 0xffff888018050a80 (size 64): comm "syz.0.17", pid 10297, jiffies 4294953601 hex dump (first 32 bytes): 00 10 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ 10 0a 05 18 80 88 ff ff 10 0a 05 18 80 88 ff ff ................ backtrace (crc a8a6fc29): kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] slab_post_alloc_hook mm/slub.c:4152 [inline] slab_alloc_node mm/slub.c:4197 [inline] __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358 kmalloc_noprof include/linux/slab.h:878 [inline] extent_changeset_alloc fs/btrfs/extent_io.h:207 [inline] qgroup_reserve_data+0x1c5/0x7d0 fs/btrfs/qgroup.c:4305 btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355 btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746 btrfs_encoded_write fs/btrfs/file.c:1482 [inline] btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507 btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738 btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x77/0x7f Unreferenced object 0xffff888018050a00 (size 64): comm "syz.0.17", pid 10297, jiffies 4294953601 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 ff 0f 00 00 00 00 00 00 ................ 90 0a 05 18 80 88 ff ff 90 0a 05 18 80 88 ff ff ................ backtrace (crc cb5c9580): kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] slab_post_alloc_hook mm/slub.c:4152 [inline] slab_alloc_node mm/slub.c:4197 [inline] __kmalloc_cache_noprof+0x168/0x2c0 mm/slub.c:4358 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] ulist_prealloc+0x9c/0x110 fs/btrfs/ulist.c:114 extent_changeset_prealloc fs/btrfs/extent_io.h:217 [inline] __set_extent_bit+0x16b/0x1a70 fs/btrfs/extent-io-tree.c:1086 set_record_extent_bits+0x50/0x90 fs/btrfs/extent-io-tree.c:1821 qgroup_reserve_data+0x274/0x7d0 fs/btrfs/qgroup.c:4312 btrfs_qgroup_reserve_data+0x2e/0xb0 fs/btrfs/qgroup.c:4355 btrfs_do_encoded_write+0x92e/0x1040 fs/btrfs/inode.c:9746 btrfs_encoded_write fs/btrfs/file.c:1482 [inline] btrfs_do_write_iter+0x280/0x610 fs/btrfs/file.c:1507 btrfs_ioctl_encoded_write+0x3d6/0x490 fs/btrfs/ioctl.c:4738 btrfs_ioctl+0x6f9/0xc90 fs/btrfs/ioctl.c:-1 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fix this by freeing an extent changeset before returning from btrfs_do_encoded_write(). 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 44 days ago. ## Severity and exploitation probability - **EPSS (FIRST):** 0.2% probability of exploitation in the next 30 days, higher than 12.1% of all scored CVEs - **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog - **Threadlinqs priority:** 0.5/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability - **Published:** 2026-08-22 ## Is CVE-2026-74722 being exploited? It currently carries a trending score of 33 in the Threadlinqs vulnerability feed. ## Affected products and versions - [Linux](https://intel.threadlinqs.com/vendors/linux): Linux ## How to fix CVE-2026-74722 No vendor patch reference has been recorded for CVE-2026-74722 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise. ## Threat activity tracking CVE-2026-74722 No threat campaign in the Threadlinqs corpus currently references CVE-2026-74722, in its CVE list or as an indicator. The linkage is recomputed from the live corpus on every daily ingest, so this section fills in as soon as a tracked campaign cites the identifier. ## Sources Enriched from CVE.org, FIRST EPSS. Last verified by Threadlinqs on 2026-08-23. **Other references** - [git.kernel.org](https://git.kernel.org/stable/c/0f0da96ccb1b9f35f4d3d4540dcaab0969d9d6b0) - [git.kernel.org (e2c7e88815edd5ecfb88e7660ab9fd42bda6bc47)](https://git.kernel.org/stable/c/e2c7e88815edd5ecfb88e7660ab9fd42bda6bc47) - [git.kernel.org (20c0eeb4313f9f89d47b80b672b5846f9827cb31)](https://git.kernel.org/stable/c/20c0eeb4313f9f89d47b80b672b5846f9827cb31) - [git.kernel.org (24a8f2c29aebb753ccb962fbb25bae18d7978f6e)](https://git.kernel.org/stable/c/24a8f2c29aebb753ccb962fbb25bae18d7978f6e) - [git.kernel.org (60b50ceba6243802f8d2c0a9a7c2d549a93b1d64)](https://git.kernel.org/stable/c/60b50ceba6243802f8d2c0a9a7c2d549a93b1d64) _Showing 5 of 6 recorded references._ Canonical: https://intel.threadlinqs.com/cve/CVE-2026-74722 Full detection coverage and IOCs for threats exploiting CVE-2026-74722 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp