CVE-2026-64033Critical· 9.8▾ MidnightIn the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs: Fix use-after-free in path file creation cleanup
In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path->kobj may already have been initialized. If a later step fails, the cleanup currently calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sysfs_root_folders(srv_path).
kobject_put() may drop the last reference to srv_path->kobj and invoke the release callback, rtrs_srv_release(), which frees srv_path. The following call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then dereferences srv_path internally to access srv_path->srv, resulting in a use-after-free.
This failure path is reached before rtrs_srv_create_path_files() returns success, so the successful-path lifetime handling is not involved.
Fix this by destroying the sysfs root folders before calling kobject_put(&srv_path->kobj), so srv_path is still valid while the helper accesses it.
This issue was found by a static analysis tool I am developing.
linux_kernel >= 5.15.61, < 5.15.209linux_kernel >= 5.17, < 6.1.175linux_kernel >= 6.2, < 6.6.142linux_kernel >= 6.7, < 6.12.92linux_kernel >= 6.13, < 6.18.34linux_kernel >= 6.19, < 7.0.11linux_kernel = 7.1Upgrade past the affected range:
linux_kernel 7.0.11Connected by shared product, vendor, weakness, or advisory.
CVE-2023-2235High· 7.8A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf_group_detach function did not check the event's siblings' attach_state before calling add_ev…
CVE-2023-1281High· 7.8Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()…
CVE-2023-1829High· 7.8A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect…
CVE-2022-1055High· 7.8A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation
CVE-2022-3636Medium· 5.5A vulnerability was identified in Linux Kernel 33fc42de33278b2b3ec6f3390512987bc29a62b7
CVE-2022-3534Medium· 5.5A vulnerability has been found in Linux Kernel up to 5.10.162/5.15.85/6.0.15/6.1.1