CVE-2026-46164
Double Free in Linux Kernel Btrfs Subgroup
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a double free error in the Linux kernel's btrfs filesystem code, specifically in the function create_space_info_sub_group().
When the function kobject_init_and_add() fails during the creation of a sub_group, the sub_group object is freed twice due to two separate calls to free it: once via kobject_put() and its release callback, and once again directly in create_space_info_sub_group().
This double free occurs because after kobject_put() is called, the cleanup should be handled by the kobject release callback, but the code also calls kfree(sub_group) again, leading to the double free.
How can this vulnerability impact me? :
A double free vulnerability can lead to undefined behavior such as memory corruption, system crashes, or potential exploitation by attackers to execute arbitrary code or escalate privileges.
In the context of the Linux kernel, this could compromise system stability and security, potentially allowing attackers to cause denial of service or gain unauthorized access.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability involves a double free in the btrfs subsystem of the Linux kernel. To mitigate this vulnerability, you should update your Linux kernel to a version where this issue has been fixed.
Specifically, apply the patch that fixes the double free in create_space_info_sub_group() error path, which ensures proper cleanup by letting the kobject release callback handle the cleanup instead of freeing the sub_group twice.
Until the kernel is updated, avoid using affected btrfs features that might trigger this code path if possible.