CVE-2026-46164: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46164 Overview

CVE-2026-46164 is a double free vulnerability in the Linux kernel's btrfs filesystem. The flaw resides in the create_space_info_sub_group() error-handling path, where memory associated with a sub_group structure can be released twice when kobject_init_and_add() fails during sysfs registration. The first free occurs via the kobject release callback (space_info_release()), and the second occurs when the caller subsequently invokes kfree(sub_group) after the error return. The issue has been resolved in upstream kernel commits.

Critical Impact
A double free in kernel allocator state can corrupt the slab heap, leading to denial of service or potential local privilege escalation when triggered during btrfs space info initialization.

Affected Products

Linux kernel (btrfs subsystem) — versions containing the affected create_space_info_sub_group() code path
Stable kernel trees referenced by the upstream fix commits
Distributions shipping vulnerable btrfs sysfs handling code

Discovery Timeline

2026-05-28 - CVE-2026-46164 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46164

Vulnerability Analysis

The defect is a classic double free [CWE-415] in btrfs sysfs registration logic. When create_space_info_sub_group() allocates a new sub_group and calls btrfs_sysfs_add_space_info_type(), that helper invokes kobject_init_and_add(). If kobject_init_and_add() fails, the helper releases the kobject reference with kobject_put(&sub_group->kobj). The kobject release callback then runs space_info_release(), which calls kfree(sub_group) and returns the memory to the slab allocator.

Control then returns to create_space_info_sub_group(), which observes the error from btrfs_sysfs_add_space_info_type() and unconditionally calls kfree(sub_group) a second time on the already-freed pointer. The fix retains the assignment parent->sub_group[index] = NULL for the failure path but removes the redundant kfree(), deferring cleanup to the kobject release callback.

Root Cause

The root cause is duplicated ownership of the sub_group allocation between the kobject reference-counting infrastructure and the calling function. Both paths assume responsibility for freeing the structure on error, violating the single-owner invariant required by the slab allocator.

Attack Vector

Triggering the bug requires inducing failure in kobject_init_and_add() during btrfs space info subgroup creation. This typically requires local access and the ability to mount or manipulate btrfs filesystems. Exploitation results in slab corruption, which an attacker with kernel allocator manipulation primitives may convert into a use-after-free condition affecting adjacent slab objects.

No verified public proof-of-concept code is available. The fix is documented across multiple stable kernel commits, including a7449edf96143f192606ec8647e3167e1ecbd728 and 259af6857a1b4f1e9ef8b780353f9d11c26a22bd.

Detection Methods for CVE-2026-46164

Indicators of Compromise

Kernel panic or BUG: KASAN: double-free reports referencing space_info_release or create_space_info_sub_group in the call stack.
Slab allocator warnings such as kernel BUG at mm/slub.c correlated with btrfs sysfs operations.
Unexpected btrfs mount failures accompanied by sysfs registration errors in dmesg.

Detection Strategies

Enable CONFIG_SLUB_DEBUG, CONFIG_KASAN, or CONFIG_KFENCE on test systems to surface double-free conditions during btrfs operations.
Audit running kernel versions against the patched commits listed in the kernel.org stable tree references.
Review crash dumps for repeated kfree() invocations on identical addresses originating from btrfs space info paths.

Monitoring Recommendations

Forward kernel ring buffer messages and dmesg output to centralized logging for analysis of slab corruption events.
Alert on unexpected kernel oops or panic events on hosts mounting btrfs volumes.
Track kernel package versions across the fleet and flag systems running pre-patch builds.

How to Mitigate CVE-2026-46164

Immediate Actions Required

Apply the upstream btrfs patch from the Linux kernel stable tree that removes the redundant kfree(sub_group) in create_space_info_sub_group().
Update to a distribution kernel build that incorporates the referenced stable commits.
Restrict local user ability to mount or manipulate btrfs filesystems on multi-tenant systems until patches are deployed.

Patch Information

The fix is available in the following upstream commits: 14b22be1dd844383eb03af9b1ee3b6b25d32aeaf, 259af6857a1b4f1e9ef8b780353f9d11c26a22bd, a7449edf96143f192606ec8647e3167e1ecbd728, d2a675f2e238ec96c8e91e2718c1f910c9c8fb21, and dfd05a16b5c9d1d98b47905f37f2fccda52173d1. The corrected logic delegates sub_group cleanup to the kobject release callback after kobject_put() is invoked.

Workarounds

Avoid mounting untrusted btrfs filesystems on vulnerable kernels.
Reduce sysfs memory pressure conditions that could trigger kobject_init_and_add() failures in production workloads.
Where patching is delayed, limit btrfs administrative operations to trusted accounts only.

bash

# Verify running kernel version and check for the fix commit
uname -r

# On Debian/Ubuntu, update the kernel package
sudo apt update && sudo apt install --only-upgrade linux-image-generic

# On RHEL/CentOS/Fedora
sudo dnf update kernel

# Reboot to load the patched kernel
sudo reboot