Executive brief
A memory leak vulnerability was identified in the Linux kernel's Btrfs file system component. The Btrfs file system is widely used for managing data storage on Linux servers and workstations. This flaw could allow a local user to cause a gradual depletion of system memory, potentially leading to system instability or a crash (denial of service) over time.
Technical details
A memory leak exists in the Btrfs file system implementation within the Linux kernel. When the function `create_space_info_sub_group()` allocates elements for `space_info->sub_group[]`, it initializes kobjects using `kobject_init_and_add()`. However, the corresponding cleanup function `check_removing_space_info()` fails to call `btrfs_sysfs_remove_space_info()`, which is required to trigger `kobject_put()`. Consequently, the memory associated with `kobj->name` is never released. An attacker with local access could potentially trigger this leak repeatedly to exhaust system memory. The issue has been resolved by ensuring the proper sysfs removal function is called during cleanup.
Affected products
- Linux Linux Kernel 6.1.162 to 6.1.168, 6.6.122 to 6.6.131, 6.12.67 to 6.12.80, 6.16 to 6.18.21, 6.19 to 6.19.11, 7.0-rc1 to 7.0-rc6
Timeline
- 2026-03-01: other: Patch authored
- 2026-04-22: advisory: CVE published by kernel.org
References
- https://git.kernel.org/stable/c/1737ddeafbb1304f41ec2eede4f7366082e7c96a
- https://git.kernel.org/stable/c/3c645c6f7e5470debbb81666b230056de48f36dc
- https://git.kernel.org/stable/c/3c844d01f9874a43004c82970d8da94f9aba8949
- https://git.kernel.org/stable/c/416484f21a9d1280cf6daa7ebc10c79b59c46e48
- https://git.kernel.org/stable/c/94054ffd311a1f76b7093ba8ebf50bdb0d28337c
- https://git.kernel.org/stable/c/a4376d9a5d4c9610e69def3fc0b32c86a7ab7a41