High 7.0Published May 28, 2026

CVE-2026-46164btrfs: fix double free in create_space_info_sub_group() error path

Updated under an hour ago (Oct 27, 2026, 12:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info_sub_group() error path When kobject_init_and_add() fails, the call chain is: create_space_info_sub_group() -> btrfs_sysfs_add_space_info_type() -> kobject_init_and_add() -> failure -> kobject_put(&sub_group->kobj) -> space_info_release() -> kfree(sub_group) Then control returns to create_space_info_sub_group(), where: btrfs_sysfs_add_space_info_type() returns error -> kfree(sub_group) Thus, sub_group is freed twice. Keep parent->sub_group[index] = NULL for the failure path, but after btrfs_sysfs_add_space_info_type() has called kobject_put(), let the kobject release callback handle the cleanup.

CVSS: 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 64c7ddda83acfbaa0efb381a1928ce908c584607 before c2d59527cba6d59f0d77a75c1101ab4e69758bea; from 0bd151ce4200ca847990e05cca29a76456982ca5 before d2a675f2e238ec96c8e91e2718c1f910c9c8fb21; 190d5a7c4fe42b8c9aa46e3336389e7cb10395bb builds before 14b22be1dd844383eb03af9b1ee3b6b25d32aeaf; from f92ee31e031c7819126d2febdda0c3e91f5d2eb9 before dfd05a16b5c9d1d98b47905f37f2fccda52173d1; from f92ee31e031c7819126d2febdda0c3e91f5d2eb9 before 259af6857a1b4f1e9ef8b780353f9d11c26a22bd; from f92ee31e031c7819126d2febdda0c3e91f5d2eb9 before a7449edf96143f192606ec8647e3167e1ecbd728; from 6.1.162 before 6.1.176; from 6.6.122 before 6.6.141; and 1 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 6.1.162 before 6.2; from 6.6.122 before 6.6.141; from 6.12.67 before 6.12.90; from 6.16 before 6.18.32; from 6.19 before 7.0.7	NVD

References

References

https://git.kernel.org/stable/c/c2d59527cba6d59f0d77a75c1101ab4e69758bea
https://git.kernel.org/stable/c/d2a675f2e238ec96c8e91e2718c1f910c9c8fb21	patch
https://git.kernel.org/stable/c/14b22be1dd844383eb03af9b1ee3b6b25d32aeaf	patch
https://git.kernel.org/stable/c/dfd05a16b5c9d1d98b47905f37f2fccda52173d1	patch
https://git.kernel.org/stable/c/259af6857a1b4f1e9ef8b780353f9d11c26a22bd	patch
https://git.kernel.org/stable/c/a7449edf96143f192606ec8647e3167e1ecbd728	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.