CVE-2026-46129: btrfs: fix double free in create_space_info() error path

Q: What conditions are required to reach the double-free path?

The path requires kobject_init_and_add() to fail while create_space_info() is adding Btrfs space-info sysfs state. The caller must already be able to trigger this kernel code path; the provided data does not identify a specific user-facing trigger.

Q: Which systems are identified as affected?

The affected software list identifies the Linux kernel and Microsoft azl3 kernel 6.6.139.1-1. No unaffected or fixed version range is provided.

Q: What is the consequence of the error-path bug?

A failed kobject initialization causes space_info to be freed by the kobject release callback, after which create_space_info() attempts to free the same object again. This is a double free with high confidentiality, integrity, and availability impact in the supplied severity vector.

Published May 28, 2026

Updated

btrfs: fix double free in createspaceinfo() error path

Affected Software

11 affected componentsFixes available

Linux Linux kernel

Linux Linux kernel>=6.1.162<6.1.175

Linux Linux kernel>=6.6.122<6.6.140

Linux Linux kernel>=6.12.67<6.12.88

Linux Linux kernel>=6.18.7<6.18.30

Linux Linux kernel>=6.19.1<7.0.7

Linux Linux kernel=6.19

Linux Linux kernel=6.19-rc6

Linux Linux kernel=6.19-rc7

Linux Linux kernel=6.19-rc8

Microsoft azl3 kernel 6.6.139.1-1<6.6.141.1-1

6.6.141.1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1

Event History

May 28, 2026

CVE Published

via MITRE·09:35 AM

Data Sourced

via MITRE·09:35 AM

DescriptionSeverity

Data Sourced

via NVD·10:16 AM

RemedyDescriptionSeverityWeaknessAffected Software

May 29, 2026

Data Sourced

via Microsoft·08:06 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What conditions are required to reach the double-free path?

The path requires kobject_init_and_add() to fail while create_space_info() is adding Btrfs space-info sysfs state. The caller must already be able to trigger this kernel code path; the provided data does not identify a specific user-facing trigger.

Which systems are identified as affected?

The affected software list identifies the Linux kernel and Microsoft azl3 kernel 6.6.139.1-1. No unaffected or fixed version range is provided.

What is the consequence of the error-path bug?

A failed kobject initialization causes space_info to be freed by the kobject release callback, after which create_space_info() attempts to free the same object again. This is a double free with high confidentiality, integrity, and availability impact in the supplied severity vector.

CVE-2026-46129: btrfs: fix double free in create_space_info() error path

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to reach the double-free path?

Which systems are identified as affected?

What is the consequence of the error-path bug?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to reach the double-free path?

Which systems are identified as affected?

What is the consequence of the error-path bug?