CVE-2026-46129 Overview
CVE-2026-46129 is a double free vulnerability in the Linux kernel's btrfs filesystem. The flaw resides in the create_space_info() error handling path. When kobject_init_and_add() fails during space info initialization, the kobject release callback frees the space_info structure via space_info_release(). Control then returns to create_space_info(), which jumps to out_free and calls kfree(space_info) a second time on the already-freed memory. This double free condition affects systems mounting or operating on btrfs filesystems where the sysfs registration path encounters failure.
Critical Impact
A double free in kernel memory can lead to heap corruption, kernel panic, denial of service, and potentially privilege escalation through exploitation of allocator metadata.
Affected Products
- Linux kernel — btrfs filesystem subsystem
- Stable kernel branches referenced by commits 3f487be, 9a06097, c2670ec, dd6ade0, and f414b3a
- Distributions shipping vulnerable btrfs builds prior to applying the upstream fix
Discovery Timeline
- 2026-05-28 - CVE-2026-46129 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46129
Vulnerability Analysis
The vulnerability is a double free [CWE-415] in the btrfs create_space_info() function. The function allocates a space_info structure and registers it with sysfs through btrfs_sysfs_add_space_info_type(). That helper calls kobject_init_and_add() to attach the kobject to sysfs. When kobject_init_and_add() fails, the kernel's kobject reference counting requires the caller to invoke kobject_put() to release the partially initialized kobject.
The kobject_put() call triggers the release callback space_info_release(), which itself calls kfree(space_info). Control then returns to create_space_info(), which receives the error code and proceeds to the out_free label. At out_free, the function calls kfree(space_info) directly on the same pointer, freeing memory that has already been released.
Root Cause
The root cause is conflicting ownership of the space_info allocation between the caller (create_space_info()) and the kobject release callback. Both code paths attempt to free the same allocation when kobject_init_and_add() fails after kobject initialization has begun, resulting in two kfree() calls on the same pointer.
Attack Vector
Reaching this code path requires triggering a failure inside kobject_init_and_add(), typically via memory pressure, sysfs name collision, or a corrupted filesystem image that forces space info type registration to fail. The vulnerability is therefore most relevant on systems that allow local users to mount attacker-controlled btrfs images or that operate under heavy memory pressure. Successful exploitation of a double free can corrupt the kernel slab allocator and lead to a kernel panic or, in advanced scenarios, controlled memory corruption.
The upstream fix retains the direct kfree(space_info) for failure paths that occur before kobject initialization. Once btrfs_sysfs_add_space_info_type() has invoked kobject_put(), the patch lets the kobject release callback own the cleanup, eliminating the duplicate free.
Detection Methods for CVE-2026-46129
Indicators of Compromise
- Kernel oops or panic messages referencing space_info_release, create_space_info, or btrfs slab corruption in dmesg and /var/log/kern.log.
- KASAN reports flagging double-free or use-after-free events with call stacks including btrfs_sysfs_add_space_info_type.
- Unexpected btrfs mount failures correlated with slab allocator warnings on systems under memory pressure.
Detection Strategies
- Enable kernel hardening options such as KASAN, SLUB debug, and slub_debug=FZP on test systems to surface double free conditions during fuzzing of btrfs images.
- Audit running kernel versions against the patched commits 3f487be81292, 9a060970fd7b, c2670ec4aa49, dd6ade0fdd59, and f414b3abbba5.
- Monitor for repeated btrfs mount failures combined with kernel ring buffer warnings about freed slab objects.
Monitoring Recommendations
- Centralize kernel logs and alert on BUG:, KASAN, and general protection fault strings tied to btrfs symbols.
- Track btrfs mount activity on multi-tenant or container hosts where users may supply filesystem images.
- Inventory Linux hosts by kernel version to identify systems still running pre-patch builds of the btrfs subsystem.
How to Mitigate CVE-2026-46129
Immediate Actions Required
- Apply the upstream btrfs patch from the referenced kernel.org commits or update to a distribution kernel that includes the fix.
- Restrict the ability of unprivileged users to mount untrusted btrfs filesystem images on shared hosts.
- Reboot affected systems after kernel package updates to load the patched btrfs module.
Patch Information
The fix is available in the mainline and stable Linux kernel trees through commits Kernel Git Commit 3f487be, Kernel Git Commit 9a06097, Kernel Git Commit c2670ec, Kernel Git Commit dd6ade0, and Kernel Git Commit f414b3a. The patch removes the duplicate kfree(space_info) call after btrfs_sysfs_add_space_info_type() has already triggered the kobject release callback.
Workarounds
- Disable or avoid use of btrfs on systems where patching cannot be performed immediately, switching workloads to ext4 or xfs where feasible.
- Limit mount privileges using CAP_SYS_ADMIN restrictions, user namespace policies, and nosuid,nodev mount options for any user-provided storage.
- Use kernel live patching where supported by the distribution to deliver the fix without rebooting production systems.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
