CVE-2026-46164: btrfs: fix double free in create_space_info_sub_group() error path
btrfs: fix double free in createspaceinfosubgroup() error path
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
What conditions are required to trigger the double free?
The failure must occur in kobject_init_and_add() while create_space_info_sub_group() is creating a Btrfs space-info subgroup. The affected error path then calls kobject_put(), whose release callback frees the subgroup, before the caller attempts to free it again.
Is exploitation remote or does it require privileges?
The supplied vector identifies local attack access, high attack complexity, no privileges required, and user interaction required. It also indicates potential high impact to confidentiality, integrity, and availability.
Which products are identified as affected?
The data identifies the Linux kernel and Microsoft azl3 kernel version 6.6.139.1-1. No broader affected-version range is provided.
What is the remediation described by the fix?
After btrfs_sysfs_add_space_info_type() has invoked kobject_put() on this failure path, cleanup should be left to the kobject release callback rather than calling kfree(sub_group) again. The parent subgroup entry should still be set to NULL on failure.