Critical 9.8Published Jul 19, 2026

CVE-2026-64033RDMA/rtrs: Fix use-after-free in path file creation cleanup

Updated under an hour ago (Oct 26, 2026, 3:30 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path->kobj may already have been initialized. If a later step fails, the cleanup currently calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sysfs_root_folders(srv_path). kobject_put() may drop the last reference to srv_path->kobj and invoke the release callback, rtrs_srv_release(), which frees srv_path. The following call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then dereferences srv_path internally to access srv_path->srv, resulting in a use-after-free. This failure path is reached before rtrs_srv_create_path_files() returns success, so the successful-path lifetime handling is not involved. Fix this by destroying the sysfs root folders before calling kobject_put(&srv_path->kobj), so srv_path is still valid while the helper accesses it. This issue was found by a static analysis tool I am developing.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from bab17b761c8974a869b04462be5d4dd9aad366b4 before 01e42aabaf7632beb4bf235c7238b96c746d4144; from ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 before 548f3956e53a7f7bde912d8129010b8986d5e602; from ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 before 00904a73272b9f3ef3952fe69a833909dccad1ef; from ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 before 92060ab1c5115674cf319175550f85f68405121f; from ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 before eae62c5451e67e8b033c1681fd3b85d7e9a9a28f; from ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 before b0e9706fb2859064bb6c677554c4d20c713aa8e0; from ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 before 5b74373390113fba798a76b483837029ab010fef; from 5.15.61 before 5.15.209	CNA record
linux linux_kernel linux:linux_kernel	from 5.15.61 before 5.15.209; from 5.17 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; 7.1; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/01e42aabaf7632beb4bf235c7238b96c746d4144	patch
https://git.kernel.org/stable/c/548f3956e53a7f7bde912d8129010b8986d5e602	patch
https://git.kernel.org/stable/c/00904a73272b9f3ef3952fe69a833909dccad1ef	patch
https://git.kernel.org/stable/c/92060ab1c5115674cf319175550f85f68405121f	patch
https://git.kernel.org/stable/c/eae62c5451e67e8b033c1681fd3b85d7e9a9a28f	patch
https://git.kernel.org/stable/c/b0e9706fb2859064bb6c677554c4d20c713aa8e0	patch
https://git.kernel.org/stable/c/5b74373390113fba798a76b483837029ab010fef	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.