RDMA/rtrs: Fix use-after-free in path file creation cleanup

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-64033
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-19 16:17:43 UTC
Updated2026-07-20 15:17:04 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path->kobj may already have been initialized. If a later step fails, the cleanup currently calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sysfs_root_folders(srv_path). kobject_put() may drop the last reference to srv_path->kobj and invoke the release callback, rtrs_srv_release(), which frees srv_path. The following call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then dereferences srv_path internally to access srv_path->srv, resulting in a use-after-free. This failure path is reached before rtrs_srv_create_path_files() returns success, so the successful-path lifetime handling is not involved. Fix this by destroying the sysfs root folders before calling kobject_put(&srv_path->kobj), so srv_path is still valid while the helper accesses it. This issue was found by a static analysis tool I am developing.

Risk And Classification

Primary CVSS: v3.1 9.8 CRITICAL from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001720000 probability, percentile 0.069020000 (date 2026-07-20)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary9.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED9.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected bab17b761c8974a869b04462be5d4dd9aad366b4 01e42aabaf7632beb4bf235c7238b96c746d4144 git Not specified
CNA Linux Linux affected ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 548f3956e53a7f7bde912d8129010b8986d5e602 git Not specified
CNA Linux Linux affected ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 00904a73272b9f3ef3952fe69a833909dccad1ef git Not specified
CNA Linux Linux affected ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 92060ab1c5115674cf319175550f85f68405121f git Not specified
CNA Linux Linux affected ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 eae62c5451e67e8b033c1681fd3b85d7e9a9a28f git Not specified
CNA Linux Linux affected ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 b0e9706fb2859064bb6c677554c4d20c713aa8e0 git Not specified
CNA Linux Linux affected ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 5b74373390113fba798a76b483837029ab010fef git Not specified
CNA Linux Linux affected 5.15.61 5.15.209 semver Not specified
CNA Linux Linux affected 5.17 Not specified
CNA Linux Linux unaffected 5.17 semver Not specified
CNA Linux Linux unaffected 5.15.209 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.175 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.142 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.92 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.34 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.11 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/eae62c5451e67e8b033c1681fd3b85d7e9a9a28f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b0e9706fb2859064bb6c677554c4d20c713aa8e0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/01e42aabaf7632beb4bf235c7238b96c746d4144 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/548f3956e53a7f7bde912d8129010b8986d5e602 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5b74373390113fba798a76b483837029ab010fef 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/00904a73272b9f3ef3952fe69a833909dccad1ef 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/92060ab1c5115674cf319175550f85f68405121f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report