CVE-2026-31434

Vulnerability

Description

CVE-2026-31434 is a memory leak vulnerability in the Linux kernel's btrfs filesystem. The issue lies in the handling of sub-group space_info objects. When create_space_info_sub_group() allocates elements of space_info->sub_group[], it calls kobject_init_and_add() via btrfs_sysfs_add_space_info_type() for each element. However, during the removal process in check_removing_space_info(), the corresponding cleanup function btrfs_sysfs_remove_space_info() is not invoked. Instead, kfree() is used, which fails to release the kobject name string allocated by kobject_set_name_vargs(). This results in a persistent memory leak of the kobj->name objects [1][2].

Exploitation and

Trigger

The vulnerability can be triggered by mounting a btrfs filesystem in a way that creates sub-group space_info entries, for example, when using a dedicated data relocation block group. This can be reproduced by running the blktests test case zbd/009 on kernels built with CONFIG_DEBUG_KMEMLEAK enabled. The leak is not exploitable for arbitrary code execution or privilege escalation; it is a denial-of-service (DoS) vector through memory exhaustion, as repeated mount/unmount cycles will gradually deplete system memory [1].

Impact

An attacker with the ability to mount and unmount a btrfs filesystem (requiring local access) could repeatedly trigger the memory leak, eventually exhausting kernel memory and causing system instability or crash. The kmemleak feature reports unreferenced objects of size 16 bytes (the kobject name string), but each missing kobject_put() prevents the entire kobject from being freed, leading to a larger cumulative leak [1].

Mitigation

The fix, already merged into the Linux kernel stable tree, replaces the kfree() call with btrfs_sysfs_remove_space_info() in check_removing_space_info(), ensuring proper cleanup of the sub-group sysfs entries and their associated kobject names [4]. Users should apply the corresponding stable kernel updates to mitigate this leak. No workaround is available besides avoiding repeated mount/unmount operations on affected systems until patched.