Executive brief
A vulnerability was identified in the Linux kernel's Btrfs file system component. The issue occurs during specific error handling scenarios when the system is managing disk space information, potentially leading to a system crash or instability. This could impact the availability of services relying on Btrfs-formatted storage.
Technical details
A double-free vulnerability exists in the Btrfs file system within the 'create_space_info()' function. When 'kobject_init_and_add()' fails, the error handling path in 'btrfs_sysfs_add_space_info_type()' calls 'kobject_put()', which triggers the 'space_info_release()' callback and frees the 'space_info' object. However, the control flow then returns to 'create_space_info()', which executes a 'goto out_free' and calls 'kfree(space_info)' again on the same pointer. This flaw can be triggered during file system mount or space management operations if sysfs registration fails. Patches have been released for various stable kernel branches to ensure the kobject release callback handles the cleanup exclusively after a registration failure.
Affected products
- Linux Linux Kernel 6.19+
Timeline
- 2026-05-28: advisory: NVD publication date
- 2026-04-07: patched: Initial fix committed to mainline kernel
References
- https://git.kernel.org/stable/c/3f487be81292702a59ea9dbc4088b3360a50e837
- https://git.kernel.org/stable/c/9a060970fd7b5e1c561e4ce73cb9949e4269a738
- https://git.kernel.org/stable/c/c2670ec4aa49ca226bce9776601e0da37502be07
- https://git.kernel.org/stable/c/dd6ade0fdd59218d71a981ae7c937a304e49209c
- https://git.kernel.org/stable/c/f414b3abbba59ef379a2b3c31f2bdd9358ed5e53