Linux: Double Free
CVE-2026-46164 is a high-severity double free vulnerability in Linux, with a CVSS 3.1 base score of 7.0 out of 10. It can be exploited with local access to the system by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. The record lists versions c2d59527cba6d59f0d77a75c1101ab4e69758bea, d2a675f2e238ec96c8e91e2718c1f910c9c8fb21, 14b22be1dd844383eb03af9b1ee3b6b25d32aeaf as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.14% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to c2d59527cba6d59f0d77a75c1101ab4e69758bea or d2a675f2e238ec96c8e91e2718c1f910c9c8fb21 or 14b22be1dd844383eb03af9b1ee3b6b25d32aeaf or dfd05a16b5c9d1d98b47905f37f2fccda52173d1, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.2 or 6.6.141 or 6.12.90 or 6.18.32, whichever matches your release line, or a later version.
- Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 64c7ddda83acfbaa0efb381a1928ce908c584607 up to, but not including, c2d59527cba6d59f0d77a75c1101ab4e69758bea; 0bd151ce4200ca847990e05cca29a76456982ca5 up to, but not including, d2a675f2e238ec96c8e91e2718c1f910c9c8fb21; 190d5a7c4fe42b8c9aa46e3336389e7cb10395bb up to, but not including, 14b22be1dd844383eb03af9b1ee3b6b25d32aeaf; f92ee31e031c7819126d2febdda0c3e91f5d2eb9 up to, but not including, dfd05a16b5c9d1d98b47905f37f2fccda52173d1; f92ee31e031c7819126d2febdda0c3e91f5d2eb9 up to, but not including, 259af6857a1b4f1e9ef8b780353f9d11c26a22bd; f92ee31e031c7819126d2febdda0c3e91f5d2eb9 up to, but not including, a7449edf96143f192606ec8647e3167e1ecbd728; 6.1.162 up to, but not including, 6.1.176; 6.6.122 up to, but not including, 6.6.141; and 2 more ranges | c2d59527cba6d59f0d77a75c1101ab4e69758bea, d2a675f2e238ec96c8e91e2718c1f910c9c8fb21, 14b22be1dd844383eb03af9b1ee3b6b25d32aeaf, dfd05a16b5c9d1d98b47905f37f2fccda52173d1, 259af6857a1b4f1e9ef8b780353f9d11c26a22bd, a7449edf96143f192606ec8647e3167e1ecbd728 |
| Linux | Linux Kernel | 6.1.162 up to, but not including, 6.2; 6.6.122 up to, but not including, 6.6.141; 6.12.67 up to, but not including, 6.12.90; 6.16 up to, but not including, 6.18.32; 6.19 up to, but not including, 7.0.7 | 6.2, 6.6.141, 6.12.90, 6.18.32, 7.0.7 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- HighSuccess depends on conditions outside the attacker's control.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- RequiredA user must take an action such as opening a file or link.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free in create_space_info_sub_group() error path When kobject_init_and_add() fails, the call chain is: create_space_info_sub_group() -> btrfs_sysfs_add_space_info_type() -> kobject_init_and_add() -> failure -> kobject_put(&sub_group->kobj) -> space_info_release() -> kfree(sub_group) Then control returns to create_space_info_sub_group(), where: btrfs_sysfs_add_space_info_type() returns error -> kfree(sub_group) Thus, sub_group is freed twice. Keep parent->sub_group[index] = NULL for the failure path, but after btrfs_sysfs_add_space_info_type() has called kobject_put(), let the kobject release callback handle the cleanup.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Double Free
The product calls free() twice on the same memory address.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
- Use a static analysis tool to find double free instances.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/14b22be1dd844383eb03af9b1ee3b6b25d32aeaf
- git.kernel.org/stable/c/259af6857a1b4f1e9ef8b780353f9d11c26a22bd
- git.kernel.org/stable/c/a7449edf96143f192606ec8647e3167e1ecbd728
- git.kernel.org/stable/c/d2a675f2e238ec96c8e91e2718c1f910c9c8fb21
- git.kernel.org/stable/c/dfd05a16b5c9d1d98b47905f37f2fccda52173d1
Other references
Recent Double Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.