CVE-2026-46129: btrfs: fix double free in create_space_info() error path

Synopsis

A double-free memory corruption bug exists in the Linux kernel's btrfs (B-Tree File System) subsystem, specifically in the create_space_info() error-handling path. The vulnerability is reachable locally by a low-privileged user and does not require any network access or victim interaction. Successful exploitation gives an attacker full read, write, and execution control within the affected kernel context, enabling data theft, data tampering, or a complete system compromise. A patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to reach the vulnerable code path; no administrative credentials are needed.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the double-free entirely through their own process without involving another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker reads arbitrary kernel memory, including stored credentials, session tokens, and other sensitive data from co-located processes.
• The attacker writes to arbitrary kernel memory, allowing modification of persisted filesystem data, security policies, or running process state.
• The double-free can be used to execute attacker-controlled code at kernel privilege, giving full control over the host operating system.
• All three impact dimensions (confidentiality, integrity, availability) are rated HIGH, so the attacker can also crash the affected system entirely, causing a denial of service.