CVE-2026-46164

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: fix double free in create_space_info_sub_group() error path<br /> <br /> When kobject_init_and_add() fails, the call chain is:<br /> <br /> create_space_info_sub_group()<br /> -&gt; btrfs_sysfs_add_space_info_type()<br /> -&gt; kobject_init_and_add()<br /> -&gt; failure<br /> -&gt; kobject_put(&amp;sub_group-&gt;kobj)<br /> -&gt; space_info_release()<br /> -&gt; kfree(sub_group)<br /> <br /> Then control returns to create_space_info_sub_group(), where:<br /> <br /> btrfs_sysfs_add_space_info_type() returns error<br /> -&gt; kfree(sub_group)<br /> <br /> Thus, sub_group is freed twice.<br /> <br /> Keep parent-&gt;sub_group[index] = NULL for the failure path, but after<br /> btrfs_sysfs_add_space_info_type() has called kobject_put(), let the<br /> kobject release callback handle the cleanup.