PT-2026-44252 · Linux · Linux

Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-46129

Mitre

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix double free in create space info() error path

When kobject init and add() fails, the call chain is:

create space info() -> btrfs sysfs add space info type() -> kobject init and add() -> failure -> kobject put(&space info->kobj) -> space info release() -> kfree(space info)

Then control returns to create space info():

btrfs sysfs add space info type() returns error -> goto out free -> kfree(space info)

This causes a double free.

Keep the direct kfree(space info) for the earlier failure path, but after btrfs sysfs add space info type() has called kobject put(), let the kobject release callback handle the cleanup.

Fix

Related Identifiers

CVE-2026-46129

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-46129 · Security Note
• https://git.kernel.org/stable/c/f414b3abbba59ef379a2b3c31f2bdd9358ed5e53 · Note
• https://git.kernel.org/stable/c/dd6ade0fdd59218d71a981ae7c937a304e49209c · Note
• https://git.kernel.org/stable/c/9a060970fd7b5e1c561e4ce73cb9949e4269a738 · Note
• https://git.kernel.org/stable/c/3f487be81292702a59ea9dbc4088b3360a50e837 · Note
• https://git.kernel.org/stable/c/c2670ec4aa49ca226bce9776601e0da37502be07 · Note