CVE-2026-31434: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31434 is a memory leak vulnerability in the Linux kernel's btrfs filesystem subsystem, specifically in the handling of space_info sub-group kobject initialization. When create_space_info_sub_group() allocates and initializes elements of space_info->sub_group[] via kobject_init_and_add(), the corresponding cleanup function check_removing_space_info() fails to call btrfs_sysfs_remove_space_info(), leaving kobj->name memory allocations unreleased. Affected kernel versions include 6.1.162–6.1.167, 6.6.122–6.6.130, 6.12.67–6.12.79, 6.16–6.18.20, 6.19–6.19.10, and 7.0-rc1 through rc6. The vulnerability was published on April 22, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-911 (Improper Update of Reference Count). During a btrfs mount operation, create_space_info_sub_group() calls btrfs_sysfs_add_space_info_type() for each sub-group element, which internally invokes kobject_init_and_add() — allocating a name string via kstrdup(). When the filesystem is unmounted and check_removing_space_info() is called, it uses kfree() directly on these elements instead of btrfs_sysfs_remove_space_info(), bypassing the required kobject_put() call and leaving the associated kobj->name memory unreleased. The fix replaces the kfree() call with btrfs_sysfs_remove_space_info() to properly decrement the kobject reference count and free associated resources. The leak is reproducible using the blktests zbd/009 test case on kernels built with CONFIG_DEBUG_KMEMLEAK (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation causes kernel memory to be leaked each time a btrfs filesystem with sub-group space_info entries is mounted and unmounted, as the kobj->name allocations are never freed. Over time, repeated mount/unmount cycles can exhaust kernel memory, degrading system performance and potentially causing a denial of service condition. The vulnerability has no confidentiality or integrity impact; only availability is affected, and exploitation is limited to local users with at least low-level privileges (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges to trigger via btrfs mount operations. The EPSS score is 0.024% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat CVE).

• Logs: Kernel memory leak reports from CONFIG_DEBUG_KMEMLEAK referencing kstrdup/kobject_set_name_vargs/kobject_init_and_add in the btrfs call stack; kmemleak output showing unreferenced objects of size 16 with content matching btrfs space_info type names (e.g., data-reloc).
• Process: Repeated mount operations on btrfs filesystems (especially with zoned block devices) by low-privileged users without corresponding unmount cleanup.
• System: Gradual unexplained increase in kernel memory consumption (/proc/meminfo showing rising Slab usage) correlated with btrfs mount/unmount activity.

Patches are available in the following kernel stable branches: 6.1.168+, 6.6.131+, 6.12.80+, 6.18.21+, 6.19.11+, and 7.0 final release. Administrators should update to a patched kernel version as the primary remediation. As a temporary workaround where immediate patching is not feasible, restrict btrfs mount operations to trusted users and monitor kernel memory usage (e.g., via /sys/kernel/debug/kmemleak) for signs of memory exhaustion related to btrfs activity (Red Hat CVE, Red Hat Bugzilla, Kernel Patches).