{"cve":"CVE-2026-46164","nvd":{"published":"2026-05-28T10:16:32.043","modified":"2026-06-19T13:16:34.477","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix double free in create_space_info_sub_group() error path\n\nWhen kobject_init_and_add() fails, the call chain is:\n\ncreate_space_info_sub_group()\n-> btrfs_sysfs_add_space_info_type()\n-> kobject_init_and_add()\n-> failure\n-> kobject_put(&sub_group->kobj)\n-> space_info_release()\n-> kfree(sub_group)\n\nThen control returns to create_space_info_sub_group(), where:\n\nbtrfs_sysfs_add_space_info_type() returns error\n-> kfree(sub_group)\n\nThus, sub_group is freed twice.\n\nKeep parent->sub_group[index] = NULL for the failure path, but after\nbtrfs_sysfs_add_space_info_type() has called kobject_put(), let the\nkobject release callback handle the cleanup.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.0},"cwes":["CWE-415"],"references":["https://git.kernel.org/stable/c/14b22be1dd844383eb03af9b1ee3b6b25d32aeaf","https://git.kernel.org/stable/c/259af6857a1b4f1e9ef8b780353f9d11c26a22bd","https://git.kernel.org/stable/c/a7449edf96143f192606ec8647e3167e1ecbd728","https://git.kernel.org/stable/c/c2d59527cba6d59f0d77a75c1101ab4e69758bea","https://git.kernel.org/stable/c/d2a675f2e238ec96c8e91e2718c1f910c9c8fb21"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:36:28.938604137+00:00"},"epss":{"cve":"CVE-2026-46164","score":0.00136,"percentile":0.03061,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}