CVE-2026-46164

Technical summary

CVE-2026-46164 is a double-free vulnerability in the Btrfs filesystem's create_space_info_sub_group() function. When kobject_init_and_add() fails during sysfs registration of a space info subgroup, the error handling chain results in the sub_group structure being freed twice: once by the kobject release callback (space_info_release()) triggered by kobject_put(), and again by the caller function's error path. The root cause is inadequate separation of responsibility between btrfs_sysfs_add_space_info_type() and its caller regarding ownership of the sub_group allocation. The fix ensures that parent->sub_group[index] remains NULL on failure and allows the kobject callback to handle cleanup without redundant kfree() calls.

Business impact

Exploitation of this vulnerability could allow unprivileged local users to trigger a kernel panic or memory corruption, affecting system availability and potentially confidentiality or integrity depending on how the freed memory is reused. For organizations running Btrfs-based infrastructure—particularly in cloud environments, container hosts, or NAS appliances—this represents a denial-of-service and potential privilege escalation risk. Systems with multi-tenant or untrusted-user scenarios are at heightened risk.

Affected systems

The Linux kernel is affected. Systems using the Btrfs filesystem are at risk, particularly those where local users or container tenants can trigger filesystem initialization errors (e.g., by mounting Btrfs volumes with specific metadata patterns or during dynamic space group reconfiguration). Verify against vendor advisories for specific kernel versions containing this code path.

Exploitability

Exploitation requires local access and the ability to induce the error condition in create_space_info_sub_group(), making the attack vector local with high complexity. The CVSS score of 7.0 (HIGH) reflects the serious impact on system stability and potential for privilege escalation, but the high complexity and requirement for user interaction temper the risk relative to remote exploits. This is not currently tracked as a known exploited vulnerability in the wild.

Remediation

Apply a kernel update that includes the fix for CVE-2026-46164. The patch modifies the error handling in create_space_info_sub_group() to properly delegate memory cleanup to the kobject release callback, eliminating the double-free condition. Verify the specific patched kernel version from your Linux distribution or the upstream kernel project.

Patch guidance

Check your Linux distribution's security advisories for kernel updates addressing this issue. Patches should be available from upstream linux kernel repositories and distribution maintainers (Ubuntu, RHEL, Debian, SUSE, etc.). Test patches in non-production environments before broad deployment. For systems using Btrfs heavily, prioritize this update within your standard patching cycle. No workaround exists other than updating the kernel.

Detection guidance

Monitor system logs for kernel oops or panic messages related to Btrfs sysfs operations, particularly those mentioning space_info or kobject errors. Use dynamic analysis tools (KASAN, UBSAN) in test environments to detect double-free conditions. Kernel tracing with ftrace or eBPF can capture calls to btrfs_sysfs_add_space_info_type() and their outcomes. Validate running kernel versions against upstream advisories to confirm whether your deployment includes the vulnerable code.

Why prioritize this

A CVSS 7.0 (HIGH) kernel memory vulnerability affecting a widely-used filesystem deserves prompt attention. While exploitation requires local access and induced error conditions, the impact on system stability and the potential for privilege escalation in multi-tenant or untrusted-user environments make this a material risk. Organizations using Btrfs should prioritize this patch; others should schedule it in their normal cycle.

Risk score, explained

The score of 7.0 reflects HIGH severity due to high impact on confidentiality, integrity, and availability (C:H/I:H/A:H), but is moderated by the requirement for local access (AV:L), high attack complexity to trigger the error path (AC:H), and user interaction needed to induce the condition (UI:R). The vulnerability is serious for local attackers but not as critical as remote or network-accessible flaws.

Frequently asked questions