PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46164 Linux CVE debrief

A double-free vulnerability exists in the Linux kernel's Btrfs filesystem driver, specifically within the `create_space_info_sub_group()` function. When `kobject_init_and_add()` fails during sysfs registration, the error handling path incorrectly frees memory that has already been released by the kobject's release callback. This occurs because `kobject_put()` triggers `space_info_release()`, which calls `kfree(sub_group)`, but control then returns to `create_space_info_sub_group()` where an additional `kfree(sub_group)` is executed. The fix ensures that after `btrfs_sysfs_add_space_info_type()` calls `kobject_put()`, the kobject release callback handles cleanup exclusively, preventing the redundant free operation.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-19
Advisory published
2026-05-28
Advisory updated
2026-06-19

Who should care

Linux system administrators running Btrfs filesystems, kernel maintainers, and security teams responsible for fleet kernel patch management

Technical summary

The vulnerability stems from improper error handling in the Btrfs space info subsystem. When sysfs registration fails via `kobject_init_and_add()`, the kobject's reference counting mechanism automatically invokes `space_info_release()` through `kobject_put()`, which frees the `sub_group` structure. However, the calling function `create_space_info_sub_group()` subsequently executes its own `kfree(sub_group)`, resulting in a use-after-free condition on the freed pointer and potential kernel memory corruption. The resolution modifies the error path to set `parent->sub_group[index] = NULL` while deferring all cleanup to the kobject release callback, eliminating the duplicate free.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches as referenced in official CVE record
  • Update to patched kernel versions when available from distribution maintainers
  • Monitor Btrfs filesystem operations for stability issues on unpatched systems
  • Review kernel crash logs for signs of memory corruption in space info sub-group handling

Evidence notes

Vulnerability description and fix details sourced from official CVE record and kernel.org git commits. The issue was resolved by modifying error handling in `create_space_info_sub_group()` to avoid duplicate memory deallocation.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46164 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46164

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46164 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46164

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/14b22be1dd844383eb03af9b1ee3b6b25d32aeaf

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/259af6857a1b4f1e9ef8b780353f9d11c26a22bd

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a7449edf96143f192606ec8647e3167e1ecbd728

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d2a675f2e238ec96c8e91e2718c1f910c9c8fb21

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/dfd05a16b5c9d1d98b47905f37f2fccda52173d1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.