CVE-2026-64033

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs: Fix use-after-free in path file creation cleanup

In the error path of rtrs_srv_create_path_files(), the sysfs root folders

may already have been created and srv_path->kobj may already have been

initialized. If a later step fails, the cleanup currently calls

kobject_put(&srv_path->kobj) before

rtrs_srv_destroy_once_sysfs_root_folders(srv_path).

kobject_put() may drop the last reference to srv_path->kobj and invoke the

release callback, rtrs_srv_release(), which frees srv_path. The following

call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then

dereferences srv_path internally to access srv_path->srv, resulting in a

use-after-free.

This failure path is reached before rtrs_srv_create_path_files() returns

success, so the successful-path lifetime handling is not involved.

Fix this by destroying the sysfs root folders before calling

kobject_put(&srv_path->kobj), so srv_path is still valid while the

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References