CVE-2026-46164 btrfs: fix double free in create_space_info_sub_group() error path

High 7.0 Published 28 May 2026 Updated 5 Aug 2026

A double free vulnerability in the Linux kernel's btrfs filesystem allows attackers to cause a denial of service or potentially execute arbitrary code.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-46164?

CVE-2026-46164 is a high-severity use after free vulnerability in Linux kernel, published on 28 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix double free in create_space_info_sub_group() error path

When kobject_init_and_add() fails, the call chain is:

create_space_info_sub_group() -> btrfs_sysfs_add_space_info_type() -> kobject_init_and_add() -> failure -> kobject_put(&sub_group->kobj) -> space_info_release() -> kfree(sub_group)

Then control returns to create_space_info_sub_group(), where:

btrfs_sysfs_add_space_info_type() returns error -> kfree(sub_group)

Thus, sub_group is freed twice.

Keep parent->sub_group[index] = NULL for the failure path, but after btrfs_sysfs_add_space_info_type() has called kobject_put(), let the kobject release callback handle the cleanup.

Weakness: CWE-415

Which versions are affected by CVE-2026-46164?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-46164?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-46164 being exploited?

There is no known exploitation of CVE-2026-46164 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as AZL-88845, BELL-CVE-2026-46164, DEBIAN-CVE-2026-46164, GHSA-rv72-f625-5h95, ROOT-OS-DEBIAN-12-CVE-2026-46164, ROOT-OS-UBUNTU-2404-CVE-2026-46164 and 1 more.