In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs: Fix use-after-free in path file creation cleanup

In the error path of rtrs_srv_create_path_files(), the sysfs root folders
may already have been created and srv_path->kobj may already have been
initialized. If a later step fails, the cleanup currently calls
kobject_put(&srv_path->kobj) before
rtrs_srv_destroy_once_sysfs_root_folders(srv_path).

kobject_put() may drop the last reference to srv_path->kobj and invoke the
release callback, rtrs_srv_release(), which frees srv_path. The following
call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then
dereferences srv_path internally to access srv_path->srv, resulting in a
use-after-free.

This failure path is reached before rtrs_srv_create_path_files() returns
success, so the successful-path lifetime handling is not involved.

Fix this by destroying the sysfs root folders before calling
kobject_put(&srv_path->kobj), so srv_path is still valid while the helper
accesses it.

This issue was found by a static analysis tool I am developing.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00172.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
bab17b761c8974a869b04462be5d4dd9aad366b4 affected < 01e42aabaf7632beb4bf235c7238b96c746d4144
ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 affected < 548f3956e53a7f7bde912d8129010b8986d5e602
ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 affected < 00904a73272b9f3ef3952fe69a833909dccad1ef
ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 affected < 92060ab1c5115674cf319175550f85f68405121f
ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 affected < eae62c5451e67e8b033c1681fd3b85d7e9a9a28f
ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 affected < b0e9706fb2859064bb6c677554c4d20c713aa8e0
ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 affected < 5b74373390113fba798a76b483837029ab010fef
5.15.61 affected < 5.15.209
Linux Linux affected
Version Status Constraints
5.17 affected —
0 unaffected < 5.17
5.15.209 unaffected ≤ 5.15.*
6.1.175 unaffected ≤ 6.1.*
6.6.142 unaffected ≤ 6.6.*
6.12.92 unaffected ≤ 6.12.*
6.18.34 unaffected ≤ 6.18.*
7.0.11 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8575-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8576-1 Linux kernel (NVIDIA Tegra) vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/00904a73272b9f3ef3952fe69a833909dccad1ef cve-icon
https://git.kernel.org/stable/c/01e42aabaf7632beb4bf235c7238b96c746d4144 cve-icon
https://git.kernel.org/stable/c/548f3956e53a7f7bde912d8129010b8986d5e602 cve-icon
https://git.kernel.org/stable/c/5b74373390113fba798a76b483837029ab010fef cve-icon
https://git.kernel.org/stable/c/92060ab1c5115674cf319175550f85f68405121f cve-icon
https://git.kernel.org/stable/c/b0e9706fb2859064bb6c677554c4d20c713aa8e0 cve-icon
https://git.kernel.org/stable/c/eae62c5451e67e8b033c1681fd3b85d7e9a9a28f cve-icon
History

Mon, 20 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sun, 19 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path->kobj may already have been initialized. If a later step fails, the cleanup currently calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sysfs_root_folders(srv_path). kobject_put() may drop the last reference to srv_path->kobj and invoke the release callback, rtrs_srv_release(), which frees srv_path. The following call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then dereferences srv_path internally to access srv_path->srv, resulting in a use-after-free. This failure path is reached before rtrs_srv_create_path_files() returns success, so the successful-path lifetime handling is not involved. Fix this by destroying the sysfs root folders before calling kobject_put(&srv_path->kobj), so srv_path is still valid while the helper accesses it. This issue was found by a static analysis tool I am developing.
Title RDMA/rtrs: Fix use-after-free in path file creation cleanup
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-20T13:42:36.830Z

Reserved: 2026-07-19T07:54:57.028Z

Link: CVE-2026-64033

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T08:00:04Z

Weaknesses

No weakness.