CVE-2026-64033
- Source
- https://cve.org/CVERecord?id=CVE-2026-64033
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64033.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-64033
- Downstream
- Published
- 2026-07-19T15:39:22.872Z
- Modified
- 2026-07-22T05:29:55.160316266Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- RDMA/rtrs: Fix use-after-free in path file creation cleanup
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs: Fix use-after-free in path file creation cleanup
In the error path of rtrssrvcreatepathfiles(), the sysfs root folders may already have been created and srvpath->kobj may already have been initialized. If a later step fails, the cleanup currently calls kobjectput(&srvpath->kobj) before rtrssrvdestroyoncesysfsrootfolders(srvpath).
kobjectput() may drop the last reference to srvpath->kobj and invoke the release callback, rtrssrvrelease(), which frees srvpath. The following call to rtrssrvdestroyoncesysfsrootfolders(srvpath) then dereferences srvpath internally to access srvpath->srv, resulting in a use-after-free.
This failure path is reached before rtrssrvcreatepathfiles() returns success, so the successful-path lifetime handling is not involved.
Fix this by destroying the sysfs root folders before calling kobjectput(&srvpath->kobj), so srv_path is still valid while the helper accesses it.
This issue was found by a static analysis tool I am developing.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64033.json" }- References
-
- https://git.kernel.org/stable/c/00904a73272b9f3ef3952fe69a833909dccad1ef
- https://git.kernel.org/stable/c/01e42aabaf7632beb4bf235c7238b96c746d4144
- https://git.kernel.org/stable/c/548f3956e53a7f7bde912d8129010b8986d5e602
- https://git.kernel.org/stable/c/5b74373390113fba798a76b483837029ab010fef
- https://git.kernel.org/stable/c/92060ab1c5115674cf319175550f85f68405121f
- https://git.kernel.org/stable/c/b0e9706fb2859064bb6c677554c4d20c713aa8e0
- https://git.kernel.org/stable/c/eae62c5451e67e8b033c1681fd3b85d7e9a9a28f
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64033.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-64033
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedbab17b761c8974a869b04462be5d4dd9aad366b4Fixed01e42aabaf7632beb4bf235c7238b96c746d4144
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedae4c81644e9105d9f7f713bb0d444737bb6a0cf1Fixed548f3956e53a7f7bde912d8129010b8986d5e602Fixed00904a73272b9f3ef3952fe69a833909dccad1efFixed92060ab1c5115674cf319175550f85f68405121fFixedeae62c5451e67e8b033c1681fd3b85d7e9a9a28fFixedb0e9706fb2859064bb6c677554c4d20c713aa8e0Fixed5b74373390113fba798a76b483837029ab010fef
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5.15.61Fixed5.15.209
Affected versions
v5.*
Linux / Kernel
Package
- Name
- Kernel
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.15.209
- Type
- ECOSYSTEM
- Events
-
Introduced5.16.0Fixed6.1.175
- Type
- ECOSYSTEM
- Events
-
Introduced5.17.0Fixed6.6.142
- Type
- ECOSYSTEM
- Events
-
Introduced6.2.0Fixed6.12.92
- Type
- ECOSYSTEM
- Events
-
Introduced6.7.0Fixed6.18.34
- Type
- ECOSYSTEM
- Events
-
Introduced6.13.0Fixed7.0.11