Executive brief
The Linux kernel's btrfs filesystem contains a memory leak in the encoded write handling code. When certain write operations are performed, allocated memory is not properly freed, causing gradual memory consumption and potential denial of service through resource exhaustion on systems using btrfs storage.
Technical details
This vulnerability is a memory leak in the btrfs_do_encoded_write() function where extent changeset structures allocated during qgroup quota reservation are not freed before the function returns. The vulnerability is triggered via the btrfs_ioctl_encoded_write ioctl, which requires local access and no special privileges. An attacker can repeatedly invoke this ioctl to gradually exhaust system memory, leading to denial of service. The fix involves properly freeing the extent changeset before returning from the function.
Affected products
- Linux Linux kernel 6.12.94 and possibly others
Timeline
- 2026-08-22: disclosed