PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46164 Linux CVE debrief

A double-free vulnerability exists in the Linux kernel's Btrfs filesystem driver, specifically within the `create_space_info_sub_group()` function. When `kobject_init_and_add()` fails during sysfs registration, the error handling path incorrectly frees memory that has already been released by the kobject's release callback. This occurs because `kobject_put()` triggers `space_info_release()`, which calls `kfree(sub_group)`, but control then returns to `create_space_info_sub_group()` where an additional `kfree(sub_group)` is executed. The fix ensures that after `btrfs_sysfs_add_space_info_type()` calls `kobject_put()`, the kobject release callback handles cleanup exclusively, preventing the redundant free operation.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-30
Advisory published
2026-05-28
Advisory updated
2026-05-30

Who should care

Linux system administrators running Btrfs filesystems, kernel maintainers, and security teams responsible for fleet kernel patch management

Technical summary

The vulnerability stems from improper error handling in the Btrfs space info subsystem. When sysfs registration fails via `kobject_init_and_add()`, the kobject's reference counting mechanism automatically invokes `space_info_release()` through `kobject_put()`, which frees the `sub_group` structure. However, the calling function `create_space_info_sub_group()` subsequently executes its own `kfree(sub_group)`, resulting in a use-after-free condition on the freed pointer and potential kernel memory corruption. The resolution modifies the error path to set `parent->sub_group[index] = NULL` while deferring all cleanup to the kobject release callback, eliminating the duplicate free.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches as referenced in official CVE record
  • Update to patched kernel versions when available from distribution maintainers
  • Monitor Btrfs filesystem operations for stability issues on unpatched systems
  • Review kernel crash logs for signs of memory corruption in space info sub-group handling

Evidence notes

Vulnerability description and fix details sourced from official CVE record and kernel.org git commits. The issue was resolved by modifying error handling in `create_space_info_sub_group()` to avoid duplicate memory deallocation.

Official resources

2026-05-28