From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7A4A03A5E96 for ; Sun, 19 Jul 2026 15:40:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784475642; cv=none; b=e+vsv704zBUEPHhNmUhZuaXOdVrSYOeiem+xlBk4iALZmSJ2OiPSt62XuykCmo4+tToQznoNY2sZ85jBDXoav+KKCeIIl5OcHrcUFhSpxlszWzRykzk0i8dgllvukZZOz32EWpIr0h7preW/jxC2qwDOYEeRRMUQPZ1caW1oReU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784475642; c=relaxed/simple; bh=oAwn4t8JFI9Kfu13P1kYS6tMsks191CLworSLTp4Z0o=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=TmQVlF0yuwWpoTXyI6+Ncj1InAOgCubhySQFuVQHI4H74XQBkfYxHWU0ySoTuGVoRUJfmTxgMu2iNh4lBtNxMFgJKzzu0wAITFr4Oh5uOwDoDKps/hAJhHqB5m+TKmgt6QEQ5Q3sNNVJdEoeSrJmbIVN0hfkR/W4gzde6ljMf1w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FGEsNwBU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="FGEsNwBU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 994D41F000E9; Sun, 19 Jul 2026 15:40:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784475641; bh=4yM1O5TfzWVKd9HHqyN6jTM4v4+AfCiTXSXKVQVfXMI=; h=From:To:Cc:Subject:Date:Reply-To; b=FGEsNwBUAgohyXzdXDPlzG+ZWMeANWLumy/dKxHlXQyk560hFpbS2FqCpSn4Rnd7u vZIL42+xvcVa7fvzI4pZghOOBcm1Tkcy0ZIs6RBYtB9Ywkpre7AoFEJEQ/40Jy9cPl DEaBatz/xd/KBN0WzcO77fZaS0q7SYHtCENuycxI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64033: RDMA/rtrs: Fix use-after-free in path file creation cleanup Date: Sun, 19 Jul 2026 17:38:15 +0200 Message-ID: <2026071904-CVE-2026-64033-b08e@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3908; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=W58ZnBz36QX2H7ob/au43M5Th9cszBFQYJU4mXsSruw=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkx72Nu116s7NFb1ffB+ptm41LVN3qsJ7T53wVsO/2bv /8Aj1tORywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAExk5lGG+T6f1B0mWrUf1Ny0 U4DvjL6KljPPOoZ5NlI7u8Uq7Zl5eqs0rLhPfJsanpUCAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path->kobj may already have been initialized. If a later step fails, the cleanup currently calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sysfs_root_folders(srv_path). kobject_put() may drop the last reference to srv_path->kobj and invoke the release callback, rtrs_srv_release(), which frees srv_path. The following call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then dereferences srv_path internally to access srv_path->srv, resulting in a use-after-free. This failure path is reached before rtrs_srv_create_path_files() returns success, so the successful-path lifetime handling is not involved. Fix this by destroying the sysfs root folders before calling kobject_put(&srv_path->kobj), so srv_path is still valid while the helper accesses it. This issue was found by a static analysis tool I am developing. The Linux kernel CVE team has assigned CVE-2026-64033 to this issue. Affected and fixed versions =========================== Issue introduced in 5.15.61 with commit bab17b761c8974a869b04462be5d4dd9aad366b4 and fixed in 5.15.209 with commit 01e42aabaf7632beb4bf235c7238b96c746d4144 Issue introduced in 5.17 with commit ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 and fixed in 6.1.175 with commit 548f3956e53a7f7bde912d8129010b8986d5e602 Issue introduced in 5.17 with commit ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 and fixed in 6.6.142 with commit 00904a73272b9f3ef3952fe69a833909dccad1ef Issue introduced in 5.17 with commit ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 and fixed in 6.12.92 with commit 92060ab1c5115674cf319175550f85f68405121f Issue introduced in 5.17 with commit ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 and fixed in 6.18.34 with commit eae62c5451e67e8b033c1681fd3b85d7e9a9a28f Issue introduced in 5.17 with commit ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 and fixed in 7.0.11 with commit b0e9706fb2859064bb6c677554c4d20c713aa8e0 Issue introduced in 5.17 with commit ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 and fixed in 7.1 with commit 5b74373390113fba798a76b483837029ab010fef Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64033 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/01e42aabaf7632beb4bf235c7238b96c746d4144 https://git.kernel.org/stable/c/548f3956e53a7f7bde912d8129010b8986d5e602 https://git.kernel.org/stable/c/00904a73272b9f3ef3952fe69a833909dccad1ef https://git.kernel.org/stable/c/92060ab1c5115674cf319175550f85f68405121f https://git.kernel.org/stable/c/eae62c5451e67e8b033c1681fd3b85d7e9a9a28f https://git.kernel.org/stable/c/b0e9706fb2859064bb6c677554c4d20c713aa8e0 https://git.kernel.org/stable/c/5b74373390113fba798a76b483837029ab010fef