Security readout for executives and security teams
Plain-English summary
A Linux Btrfs error-handling bug can free the same kernel object twice when sysfs setup fails. This could corrupt kernel memory, crash a system, or potentially enable deeper compromise by a local low-privileged user. It is not a direct remote vulnerability, and the supplied sources provide no evidence of exploitation.
Executive priority
Treat this as a high-priority kernel maintenance issue on shared or security-sensitive Btrfs systems. It does not warrant internet-facing emergency response solely from the supplied evidence, but delayed remediation increases local privilege-escalation and stability risk. Require asset identification, vendor-confirmed patch status, and verification that the corrected kernel is actually running.
Technical view
If kobject_init_and_add() fails, kobject_put() invokes space_info_release(), which frees space_info. Control then returns to create_space_info(), whose error path frees the same allocation again. The fix preserves direct cleanup for earlier failures but relies on the kobject release callback once kobject ownership exists.
Likely exposure
Exposure is local rather than directly network-accessible. Prioritize Linux systems using Btrfs where low-privileged users can execute code. The supplied version records are difficult to interpret and include branch versions plus commit identifiers, so confirm exposure using distribution guidance, kernel build provenance, and equivalent-backport checks rather than version strings alone.
Exploitation context
The CVSS 3.1 score is 7.8 with local, low-privilege, no-user-interaction requirements and potentially high confidentiality, integrity, and availability impact. The bundle marks KEV false and cites no active exploitation, public proof of concept, reliable trigger conditions, or demonstrated path from the double free to code execution.
Researcher notes
The double-free mechanism and intended cleanup correction are clearly described, but practical reachability and exploitability are not established. The bundle provides no CWE, trigger proof, exploit evidence, or reliable distribution-package mapping. Researchers should focus validation on error-path ownership, applicable stable-branch backports, and whether local unprivileged activity can reach the vulnerable path without assuming code execution.
Mitigation direction
- Inventory Linux systems using Btrfs and record their running kernel versions, build identifiers, and distribution packages.
- Apply vendor kernel updates incorporating the applicable upstream fix or an equivalent backport.
- Activate the updated kernel according to vendor instructions and established change-control procedures.
- Until updated, restrict unnecessary local accounts and untrusted code execution on relevant hosts.
- Monitor vendor advisories because the supplied affected-version mapping is ambiguous.
Validation and detection
- Confirm the remediated kernel is running, rather than merely installed on disk.
- Check vendor changelogs or kernel source for an applicable referenced fix or equivalent backport.
- Review kernel logs for double-free, memory-corruption, Btrfs, kobject, allocator, or unexpected-reboot indicators.
- Run approved Btrfs regression tests in a non-production environment after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-46129 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ae6d6e31ceb72b7697c28a528e4923c08e3c2ef5CVE reference, Linux
- https://git.kernel.org/stable/c/c2670ec4aa49ca226bce9776601e0da37502be07CVE reference, Linux
- https://git.kernel.org/stable/c/f414b3abbba59ef379a2b3c31f2bdd9358ed5e53CVE reference, Linux
- https://git.kernel.org/stable/c/9a060970fd7b5e1c561e4ce73cb9949e4269a738CVE reference, Linux
- https://git.kernel.org/stable/c/dd6ade0fdd59218d71a981ae7c937a304e49209cCVE reference, Linux
- https://git.kernel.org/stable/c/3f487be81292702a59ea9dbc4088b3360a50e837CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.