CVE-2026-64033

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/rtrs: Fix use-after-free in path file creation cleanup<br /> <br /> In the error path of rtrs_srv_create_path_files(), the sysfs root folders<br /> may already have been created and srv_path-&gt;kobj may already have been<br /> initialized. If a later step fails, the cleanup currently calls<br /> kobject_put(&amp;srv_path-&gt;kobj) before<br /> rtrs_srv_destroy_once_sysfs_root_folders(srv_path).<br /> <br /> kobject_put() may drop the last reference to srv_path-&gt;kobj and invoke the<br /> release callback, rtrs_srv_release(), which frees srv_path. The following<br /> call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then<br /> dereferences srv_path internally to access srv_path-&gt;srv, resulting in a<br /> use-after-free.<br /> <br /> This failure path is reached before rtrs_srv_create_path_files() returns<br /> success, so the successful-path lifetime handling is not involved.<br /> <br /> Fix this by destroying the sysfs root folders before calling<br /> kobject_put(&amp;srv_path-&gt;kobj), so srv_path is still valid while the helper<br /> accesses it.<br /> <br /> This issue was found by a static analysis tool I am developing.