CVE-2026-64033

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel RDMA/rtrs Subsystem

Publication date: 2026-07-19

Last updated on: 2026-10-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path->kobj may already have been initialized. If a later step fails, the cleanup currently calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sysfs_root_folders(srv_path). kobject_put() may drop the last reference to srv_path->kobj and invoke the release callback, rtrs_srv_release(), which frees srv_path. The following call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then dereferences srv_path internally to access srv_path->srv, resulting in a use-after-free. This failure path is reached before rtrs_srv_create_path_files() returns success, so the successful-path lifetime handling is not involved. Fix this by destroying the sysfs root folders before calling kobject_put(&srv_path->kobj), so srv_path is still valid while the helper accesses it. This issue was found by a static analysis tool I am developing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-18

NVD

CVE-2026-64033

EUVD

EUVD-2026-45606

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 5.17 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)
linux	linux_kernel	From 5.15.61 (inc) to 5.15.209 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's RDMA subsystem. It occurs during cleanup of sysfs path files in the rtrs_srv_create_path_files function. When an error happens, the cleanup process calls kobject_put before destroying sysfs root folders, which may free memory that is later accessed, causing a use-after-free condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA subsystem and involves a use-after-free in the rtrs module. Detection requires checking kernel logs for related errors or kernel crashes. Commands like dmesg | grep -i rtrs or journalctl -k | grep -i rtrs may help identify issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or privilege escalation if exploited. It specifically affects systems using RDMA functionality in the Linux kernel, potentially causing instability or security breaches in affected environments.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level Linux kernel memory management issue unrelated to data protection or privacy controls.

Mitigation Strategies

Immediately update your Linux kernel to a version that includes the fix for this vulnerability. Monitor kernel logs for any signs of the described use-after-free issue. If you cannot update immediately, consider disabling the RDMA subsystem if not in use to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-64033. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70