Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-46129

btrfs: fix double free in create_space_info() error path

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info() error path When kobject_init_and_add() fails, the call chain is: create_space_info() -> btrfs_sysfs_add_space_info_type() -> kobject_init_and_add() -> failure -> kobject_put(&space_info->kobj) -> space_info_release() -> kfree(space_info) Then control returns to create_space_info(): btrfs_sysfs_add_space_info_type() returns error -> goto out_free -> kfree(space_info) This causes a double free. Keep the direct kfree(space_info) for the earlier failure path, but after btrfs_sysfs_add_space_info_type() has called kobject_put(), let the kobject release callback handle the cleanup.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 20e8f2de3688082eeafeb93c8900485b7542457e to < ae6d6e31ceb72b7697c28a528e4923c08e3c2ef5affected
  • 58208907c4044a764dbd8896026283905da6d9be to < c2670ec4aa49ca226bce9776601e0da37502be07affected
  • bb4fa4c0b54aae25e55faeda7f78d0c11b8cd618 to < f414b3abbba59ef379a2b3c31f2bdd9358ed5e53affected
  • 6cb008f1bb23e023dfe615cca5df14570dfc8da5 to < 9a060970fd7b5e1c561e4ce73cb9949e4269a738affected
  • a11224a016d6d1d46a4d9b6573244448a80d4d7f to < dd6ade0fdd59218d71a981ae7c937a304e49209caffected
  • a11224a016d6d1d46a4d9b6573244448a80d4d7f to < 3f487be81292702a59ea9dbc4088b3360a50e837affected
  • 6.1.162 to < 6.1.175affected
  • 6.6.122 to < 6.6.140affected
  • 6.12.67 to < 6.12.88affected
  • 6.18.7 to < 6.18.30affected

Linux Linux

Default version status: affected

  • 6.19affected
  • 0 to < 6.19unaffected
  • 6.1.175 to ≤ 6.1.*unaffected
  • 6.6.140 to ≤ 6.6.*unaffected
  • 6.12.88 to ≤ 6.12.*unaffected
  • 6.18.30 to ≤ 6.18.*unaffected
  • 7.0.7 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References