CVE-2026-46129

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: fix double free in create_space_info() error path<br /> <br /> When kobject_init_and_add() fails, the call chain is:<br /> <br /> create_space_info()<br /> -&gt; btrfs_sysfs_add_space_info_type()<br /> -&gt; kobject_init_and_add()<br /> -&gt; failure<br /> -&gt; kobject_put(&amp;space_info-&gt;kobj)<br /> -&gt; space_info_release()<br /> -&gt; kfree(space_info)<br /> <br /> Then control returns to create_space_info():<br /> <br /> btrfs_sysfs_add_space_info_type() returns error<br /> -&gt; goto out_free<br /> -&gt; kfree(space_info)<br /> <br /> This causes a double free.<br /> <br /> Keep the direct kfree(space_info) for the earlier failure path, but<br /> after btrfs_sysfs_add_space_info_type() has called kobject_put(), let<br /> the kobject release callback handle the cleanup.