CVE-2026-46129

Technical summary

CVE-2026-46129 is a double-free vulnerability in create_space_info() within the Btrfs subsystem. The vulnerability occurs in the error path when kobject_init_and_add() fails during space info type registration. When kobject_put() is called, it invokes the space_info_release() callback, which frees the space_info structure. Control then returns to create_space_info() where the error handler again calls kfree(space_info), resulting in a use-after-free and potential kernel code execution. The fix requires conditional logic: direct kfree() for early failure paths, but deferred cleanup via kobject callbacks after kobject_put() is invoked.

Business impact

This vulnerability poses a direct privilege escalation risk for multi-user or containerized Linux systems. Any user with local access can crash the kernel or execute arbitrary code with kernel privileges, leading to complete system compromise. For cloud providers, container orchestration platforms, and shared hosting environments, this represents a critical containment breach. Even single-user systems running untrusted services or exposed to local network attackers are at risk. Data breach, denial of service, and lateral movement to other systems are all plausible outcomes.

Affected systems

The Linux kernel versions running Btrfs filesystem code are affected. Btrfs is commonly used in enterprise Linux distributions (RHEL, Ubuntu, SLES), cloud platforms, and storage appliances. Systems must have Btrfs compiled into the kernel or loaded as a module, and must handle space information registration during filesystem operations or initialization. Verify the specific kernel version and Btrfs patch status against your vendor's security advisory for exact affected ranges.

Exploitability

The vulnerability is exploitable by local authenticated users with standard (unprivileged) permissions. Exploitation requires triggering the specific error condition in kobject_init_and_add() during space info registration, which may involve filesystem mount operations, out-of-memory scenarios, or sysfs naming conflicts. No network access or special capabilities are required. The CVSS score of 7.8 (HIGH) reflects the local attack vector, low complexity, and high impact on confidentiality, integrity, and availability.

Remediation

Patch your Linux kernel to a version that includes the fix for CVE-2026-46129. This fix modifies the error handling in create_space_info() to avoid double-free by letting the kobject release callback handle cleanup after kobject_put() is called. Verify the exact patched kernel version from your Linux distribution's security advisory. If immediate patching is not possible, restrict local user access and disable Btrfs on systems where it is not essential.

Patch guidance

Monitor your Linux distribution's security advisories and kernel update channels (kernel.org, Red Hat Security Advisories, Ubuntu Security Notices, SLES Security Updates, etc.) for patches addressing CVE-2026-46129. Apply the patch as part of your standard kernel update process. Test in a non-production environment first to ensure compatibility with your workloads. Kernel patches typically require a system reboot to take effect. Document the patch version applied for audit and compliance purposes.

Detection guidance

Monitor system logs for kernel oops, panic, or memory corruption warnings tied to Btrfs space info operations. Intrusion detection systems can monitor for abnormal privilege escalation patterns from unprivileged processes. Memory sanitizer tools (KASAN, MSAN) in debugging kernels will flag the double-free condition. However, detection after exploitation is often too late; preventive patching is the primary mitigation. Consider kernel hardening features like SMEP and SMAP to raise the bar for exploitation.

Why prioritize this

This vulnerability merits immediate patching due to its HIGH CVSS score, local privilege escalation vector, and applicability to any system running Btrfs. The simplicity of triggering the error condition and the direct path to kernel code execution make it a priority for any organization managing multi-user or container-based Linux infrastructure. Delayed patching leaves systems vulnerable to internal threat actors and compromised services.

Risk score, explained

CVSS 3.1 score of 7.8 reflects: Attack Vector = Local (AV:L), Attack Complexity = Low (AC:L), Privileges Required = Low (PR:L), User Interaction = None (UI:N), Scope = Unchanged (S:U), Confidentiality = High (C:H), Integrity = High (I:H), Availability = High (A:H). The local vector limits exposure to authenticated users, but the low complexity and high impact on all three security pillars (CIA) make this a serious kernel vulnerability.

Frequently asked questions