CVE-2026-46164
7.0 HIGHIn the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info_sub_group() error path ...
Published: 2026-05-28 · Last updated: 2026-06-10
Severity and scoring
- CVSS
- 7.0 HIGH
- Vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- CWE
- CWE-415
Affected products
| Vendor | Product |
|---|---|
| linux | linux_kernel |
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info_sub_group() error path When kobject_init_and_add() fails, the call chain is: create_space_info_sub_group() -> btrfs_sysfs_add_space_info_type() -> kobject_init_and_add() -> failure -> kobject_put(&sub_group->kobj) -> space_info_release() -> kfree(sub_group) Then control returns to create_space_info_sub_group(), where: btrfs_sysfs_add_space_info_type() returns error -> kfree(sub_group) Thus, sub_group is freed twice. Keep parent->sub_group[index] = NULL for the failure path, but after btrfs_sysfs_add_space_info_type() has called kobject_put(), let the kobject release callback handle the cleanup.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-46164
- [Patch]https://git.kernel.org/stable/c/14b22be1dd844383eb03af9b1ee3b6b25d32aeaf
- [Patch]https://git.kernel.org/stable/c/259af6857a1b4f1e9ef8b780353f9d11c26a22bd
- [Patch]https://git.kernel.org/stable/c/a7449edf96143f192606ec8647e3167e1ecbd728
- [Patch]https://git.kernel.org/stable/c/d2a675f2e238ec96c8e91e2718c1f910c9c8fb21
- [Patch]https://git.kernel.org/stable/c/dfd05a16b5c9d1d98b47905f37f2fccda52173d1
Related CVEs
Same vendor
- CVE-2026-46273 — In the Linux kernel, the following vulnerability has been resolved: ibmveth: Disable GSO for packets with small MSS Some physical adapt... (8.6 HIGH)
- CVE-2026-46272 — In the Linux kernel, the following vulnerability has been resolved: coresight: tmc-etr: Fix race condition between sysfs and perf mode ... (4.7 MEDIUM)
- CVE-2026-46271 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: do WoW offloads only on primary link In case of multi... (7.8 HIGH)
- CVE-2026-46270 — In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: Fix use-after-free in power_supply_changed() ... (8.4 HIGH)
- CVE-2026-46269 — In the Linux kernel, the following vulnerability has been resolved: pinctrl: canaan: k230: Fix NULL pointer dereference when parsing dev... (5.5 MEDIUM)
Same CWE
- CVE-2026-35188 — Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, tr... (5.0 MEDIUM)
- CVE-2026-45324 — Rizin is a UNIX-like reverse engineering framework and command-line toolset (3.3 LOW)
- CVE-2026-44422 — FreeRDP is a free implementation of the Remote Desktop Protocol (7.5 HIGH)
- CVE-2026-46189 — In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error pa... (7.8 HIGH)
- CVE-2026-46183 — In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock ... (7.8 HIGH)