CVE-2026-31434

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix leak of kobject name for sub-group space_info

When create_space_info_sub_group() allocates elements of

space_info->sub_group[], kobject_init_and_add() is called for each

element via btrfs_sysfs_add_space_info_type(). However, when

check_removing_space_info() frees these elements, it does not call

btrfs_sysfs_remove_space_info() on them. As a result, kobject_put() is

not called and the associated kobj->name objects are leaked.

This memory leak is reproduced by running the blktests test case

zbd/009 on kernels built with CONFIG_DEBUG_KMEMLEAK. The kmemleak

feature reports the following error:

unreferenced object 0xffff888112877d40 (size 16):

comm "mount", pid 1244, jiffies 4294996972

hex dump (first 16 bytes):

64 61 74 61 2d 72 65 6c 6f 63 00 c4 c6 a7 cb 7f data-reloc......

backtrace (crc 53ffde4d):

__kmalloc_node_track_caller_noprof+0x619/0x870

kstrdup+0x42/0xc0

kobject_set_name_var

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References