PT-2026-61350 · Linux · Linux

CVE-2026-64033 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs: Fix use-after-free in path file creation cleanup

In the error path of rtrs srv create path files(), the sysfs root folders may already have been created and srv path->kobj may already have been initialized. If a later step fails, the cleanup currently calls kobject put(&srv path->kobj) before rtrs srv destroy once sysfs root folders(srv path).

kobject put() may drop the last reference to srv path->kobj and invoke the release callback, rtrs srv release(), which frees srv path. The following call to rtrs srv destroy once sysfs root folders(srv path) then dereferences srv path internally to access srv path->srv, resulting in a use-after-free.

This failure path is reached before rtrs srv create path files() returns success, so the successful-path lifetime handling is not involved.

Fix this by destroying the sysfs root folders before calling kobject put(&srv path->kobj), so srv path is still valid while the helper accesses it.

This issue was found by a static analysis tool I am developing.

Fix

Related Identifiers

CVE-2026-64033

Affected Products

Linux

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-64033 · Security Note
• https://git.kernel.org/stable/c/00904a73272b9f3ef3952fe69a833909dccad1ef · Note
• https://git.kernel.org/stable/c/01e42aabaf7632beb4bf235c7238b96c746d4144 · Note
• https://git.kernel.org/stable/c/548f3956e53a7f7bde912d8129010b8986d5e602 · Note
• https://git.kernel.org/stable/c/92060ab1c5115674cf319175550f85f68405121f · Note
• https://git.kernel.org/stable/c/eae62c5451e67e8b033c1681fd3b85d7e9a9a28f · Note
• https://git.kernel.org/stable/c/5b74373390113fba798a76b483837029ab010fef · Note
• https://git.kernel.org/stable/c/b0e9706fb2859064bb6c677554c4d20c713aa8e0 · Note