CVE-2026-46164: btrfs: fix double free in create_space_info_sub_group() error path

Synopsis

A double-free vulnerability exists in the Linux kernel's btrfs filesystem driver, specifically in the create_space_info_sub_group() error-handling path. The bug is reachable locally and requires a user to trigger the relevant code path, with exploitation complicated by environmental timing factors; successful exploitation gives an attacker full read, write, and crash capability over the affected system. A patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationNot required

  No authentication or existing account is required to trigger the vulnerable code path.

• Victim interactionRequired

  A local user must take some action (such as mounting or interacting with a btrfs filesystem) to trigger the error path that causes the double free.

• Attack complexityDetail

  Exploitation depends on race conditions or specific memory layout conditions at the time of the error path, making reliable exploitation non-trivial.

Blast Radius

• A successful attacker reads arbitrary kernel memory, exposing stored credentials, session tokens, and other sensitive data.
• Controlled writes to freed kernel memory allow the attacker to overwrite kernel data structures, modifying persisted filesystem state or privileged process context.
• Triggering the double free can crash the kernel entirely, taking down all workloads running on the affected host.
• Kernel-level code execution is achievable by shaping heap layout to control the reuse of the freed sub_group allocation.