CVE-2026-46164

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info_sub_group() error path When kobject_init_and_add() fails, the call chain is: create_space_info_sub_group() -> btrfs_sysfs_add_space_info_type() -> kobject_init_and_add() -> failure -> kobject_put(&sub_group->kobj) -> space_info_release() -> kfree(sub_group) Then control returns to create_space_info_sub_group(), where: btrfs_sysfs_add_space_info_type() returns error -> kfree(sub_group) Thus, sub_group is freed twice. Keep parent->sub_group[index] = NULL for the failure path, but after btrfs_sysfs_add_space_info_type() has called kobject_put(), let the kobject release callback handle the cleanup.

CVSS v3 7.0 HIGH

7.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/14b22be1dd844383eb03af9b1ee3b6b25d32aeaf	Patch
https://git.kernel.org/stable/c/259af6857a1b4f1e9ef8b780353f9d11c26a22bd	Patch
https://git.kernel.org/stable/c/a7449edf96143f192606ec8647e3167e1ecbd728	Patch
https://git.kernel.org/stable/c/c2d59527cba6d59f0d77a75c1101ab4e69758bea
https://git.kernel.org/stable/c/d2a675f2e238ec96c8e91e2718c1f910c9c8fb21	Patch
https://git.kernel.org/stable/c/dfd05a16b5c9d1d98b47905f37f2fccda52173d1	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

No history.

Information

Published : 2026-05-28 10:16

Updated : 2026-06-19 13:16

NVD link : CVE-2026-46164

Mitre link : CVE-2026-46164

CVE.ORG link : CVE-2026-46164

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-415

Double Free

{"id": "CVE-2026-46164", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "64c7ddda83acfbaa0efb381a1928ce908c584607", "lessThan": "c2d59527cba6d59f0d77a75c1101ab4e69758bea", "versionType": "git"}, {"status": "affected", "version": "0bd151ce4200ca847990e05cca29a76456982ca5", "lessThan": "d2a675f2e238ec96c8e91e2718c1f910c9c8fb21", "versionType": "git"}, {"status": "affected", "version": "190d5a7c4fe42b8c9aa46e3336389e7cb10395bb", "lessThan": "14b22be1dd844383eb03af9b1ee3b6b25d32aeaf", "versionType": "git"}, {"status": "affected", "version": "f92ee31e031c7819126d2febdda0c3e91f5d2eb9", "lessThan": "dfd05a16b5c9d1d98b47905f37f2fccda52173d1", "versionType": "git"}, {"status": "affected", "version": "f92ee31e031c7819126d2febdda0c3e91f5d2eb9", "lessThan": "259af6857a1b4f1e9ef8b780353f9d11c26a22bd", "versionType": "git"}, {"status": "affected", "version": "f92ee31e031c7819126d2febdda0c3e91f5d2eb9", "lessThan": "a7449edf96143f192606ec8647e3167e1ecbd728", "versionType": "git"}, {"status": "affected", "version": "6.1.162", "lessThan": "6.1.176", "versionType": "semver"}, {"status": "affected", "version": "6.6.122", "lessThan": "6.6.141", "versionType": "semver"}, {"status": "affected", "version": "6.12.67", "lessThan": "6.12.90", "versionType": "semver"}], "programFiles": ["fs/btrfs/space-info.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.141", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.90", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.32", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.7", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/btrfs/space-info.c"], "defaultStatus": "affected"}]}], "published": "2026-05-28T10:16:32.043", "references": [{"url": "https://git.kernel.org/stable/c/14b22be1dd844383eb03af9b1ee3b6b25d32aeaf", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/259af6857a1b4f1e9ef8b780353f9d11c26a22bd", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a7449edf96143f192606ec8647e3167e1ecbd728", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c2d59527cba6d59f0d77a75c1101ab4e69758bea", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d2a675f2e238ec96c8e91e2718c1f910c9c8fb21", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/dfd05a16b5c9d1d98b47905f37f2fccda52173d1", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-415"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix double free in create_space_info_sub_group() error path\n\nWhen kobject_init_and_add() fails, the call chain is:\n\ncreate_space_info_sub_group()\n-> btrfs_sysfs_add_space_info_type()\n-> kobject_init_and_add()\n-> failure\n-> kobject_put(&sub_group->kobj)\n-> space_info_release()\n-> kfree(sub_group)\n\nThen control returns to create_space_info_sub_group(), where:\n\nbtrfs_sysfs_add_space_info_type() returns error\n-> kfree(sub_group)\n\nThus, sub_group is freed twice.\n\nKeep parent->sub_group[index] = NULL for the failure path, but after\nbtrfs_sysfs_add_space_info_type() has called kobject_put(), let the\nkobject release callback handle the cleanup."}], "lastModified": "2026-06-19T13:16:34.477", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC09986F-7799-41B9-80E9-13187E3E33E7", "versionEndExcluding": "6.2", "versionStartIncluding": "6.1.162"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DDACAED-DB5F-4215-90D1-9638039CD94F", "versionEndExcluding": "6.6.141", "versionStartIncluding": "6.6.122"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B62EF25-7B21-4945-BFC3-D47BBC89F73F", "versionEndExcluding": "6.12.90", "versionStartIncluding": "6.12.67"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF62AC18-3B67-498C-BE98-210B26013D50", "versionEndExcluding": "6.18.32", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E", "versionEndExcluding": "7.0.7", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}