{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-46129", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-46129" ], "published": "2026-05-28T09:36:53Z", "summary": "btrfs: fix double free in create_space_info() error path", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix double free in create_space_info() error path\n\nWhen kobject_init_and_add() fails, the call chain is:\n\ncreate_space_info()\n-> btrfs_sysfs_add_space_info_type()\n-> kobject_init_and_add()\n-> failure\n-> kobject_put(&space_info->kobj)\n-> space_info_release()\n-> kfree(space_info)\n\nThen control returns to create_space_info():\n\nbtrfs_sysfs_add_space_info_type() returns error\n-> goto out_free\n-> kfree(space_info)\n\nThis causes a double free.\n\nKeep the direct kfree(space_info) for the earlier failure path, but\nafter btrfs_sysfs_add_space_info_type() has called kobject_put(), let\nthe kobject release callback handle the cleanup.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.12.75-1+rpt1~bookworm", "1:6.12.87-1+rpt1~bookworm" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.12.75+rpt-rpi-2712", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v6", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v7", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v7l", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8-rt", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-2712", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v6", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v7", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v7l", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v8", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v8-rt", "binary_version": "1:6.12.87-1+rpt1~bookworm" } ] }, "database_specific": { "per_version": { "1:6.12.75-1+rpt1~bookworm": { "linux_commit": "89050b1059997d38d55462b323b099a6436dc10d", "upstream_version": "6.12.75", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.88" }, "1:6.12.87-1+rpt1~bookworm": { "linux_commit": "ae4d75fb36deba0fe1a986d9bfae65755e082dd0", "upstream_version": "6.12.87", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.88" } } } }, { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.12.75-1+rpt1", "1:6.18.29-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.12.75+rpt-rpi-2712", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v6", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v7", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8-rt", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.12.75-1+rpt1": { "linux_commit": "89050b1059997d38d55462b323b099a6436dc10d", "upstream_version": "6.12.75", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.88" }, "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.30" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46129" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/ae6d6e31ceb72b7697c28a528e4923c08e3c2ef5" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/c2670ec4aa49ca226bce9776601e0da37502be07" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/f414b3abbba59ef379a2b3c31f2bdd9358ed5e53" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/9a060970fd7b5e1c561e4ce73cb9949e4269a738" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/dd6ade0fdd59218d71a981ae7c937a304e49209c" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/3f487be81292702a59ea9dbc4088b3360a50e837" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T13:16:28Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - The vulnerable code is reachable only during a btrfs mount (btrfs_fill_super \u2192 open_ctree \u2192 btrfs_init_space_info \u2192 create_space_info); it requires presenting a device/image and initiating a mount locally, with no network path.\nAC:L - The failure point is kobject_init_and_add() returning an allocation error; per guidance memory pressure is attacker-influenceable, and an attacker can repeatedly retry mounts under induced pressure to hit it.\nPR:L - On typical desktops/kiosks an unprivileged user can mount attacker-supplied removable media or loop images via udisks2/autofs, so no real root in the init namespace is strictly required to initiate the triggering mount.\nUI:N - The attacker performs the mount of their own crafted image themselves, so no separate victim action is required.\nS:U - The double free corrupts kernel heap state within the kernel's own security authority with no crossing into another security domain (no VM/IOMMU boundary).\nC:H - A double free is memory corruption that can be leveraged via reallocation of the freed slot into an attacker-controlled object, enabling kernel memory disclosure.\nI:H - Double-free corruption of the heap allocator can be groomed into a write primitive / control-flow hijack, so integrity impact is High.\nA:H - A double free reliably corrupts allocator metadata and causes kernel oops/panic, yielding a High availability impact." } } }