CVE-2026-64033 Overview
CVE-2026-64033 is a use-after-free vulnerability in the Linux kernel's RDMA/rtrs (RDMA Transport) subsystem. The flaw exists in the error-handling path of rtrs_srv_create_path_files(), where cleanup logic invokes kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sysfs_root_folders(srv_path). When kobject_put() drops the last reference, the release callback rtrs_srv_release() frees srv_path. The subsequent call then dereferences the freed structure to access srv_path->srv, triggering the use-after-free condition. The issue was identified through static analysis and has been resolved upstream.
Critical Impact
Use-after-free in kernel space can lead to memory corruption, privilege escalation, or arbitrary code execution within the Linux kernel context.
Affected Products
- Linux kernel versions containing the RDMA/rtrs server sysfs path creation code
- Distributions shipping vulnerable kernel builds with RDMA/rtrs enabled
- Systems using InfiniBand or RDMA transport services on affected kernels
Discovery Timeline
- 2026-07-19 - CVE-2026-64033 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64033
Vulnerability Analysis
The vulnerability resides in the RDMA/rtrs server-side path file creation routine. During normal operation, rtrs_srv_create_path_files() initializes srv_path->kobj and creates sysfs root folders to expose RDMA path attributes. When a later step in this initialization sequence fails, the cleanup logic executes in the wrong order.
The cleanup calls kobject_put(&srv_path->kobj) first. This can drop the final reference count on the kobject, causing the kernel to invoke the release callback rtrs_srv_release(), which frees the entire srv_path structure. The subsequent call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then accesses srv_path->srv on already-freed memory.
Root Cause
The root cause is incorrect cleanup ordering in the error path. The helper function rtrs_srv_destroy_once_sysfs_root_folders() requires srv_path to remain valid because it dereferences the pointer internally. Calling kobject_put() before invoking this helper violates the object lifetime contract, since the kobject release path may free the parent structure. This is a classic [CWE-416] use-after-free pattern resulting from destructor ordering.
Attack Vector
The vulnerability requires the failure branch of rtrs_srv_create_path_files() to be reached. An attacker capable of influencing RDMA path setup, either through network-triggered RDMA connections or by inducing resource pressure that causes sysfs creation to fail, could reliably reach the vulnerable cleanup sequence. Successful exploitation reads or writes memory that has been returned to the slab allocator, which can be leveraged to corrupt adjacent kernel objects.
No public proof-of-concept exploitation code is available. The vulnerability was disclosed alongside the upstream fix. See the Kernel Patch 00904a73272b for the corrective commit reordering the cleanup sequence.
Detection Methods for CVE-2026-64033
Indicators of Compromise
- Kernel oops or panic messages referencing rtrs_srv_release, rtrs_srv_destroy_once_sysfs_root_folders, or kobject_put in the call stack
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free reads in the RDMA/rtrs code path
- Unexpected termination of RDMA server processes during path establishment failures
Detection Strategies
- Enable KASAN and slab debugging on test kernels to identify use-after-free access to srv_path structures
- Audit kernel versions across the fleet and compare against the patched stable kernel commits
- Correlate RDMA subsystem crash signatures with sysfs creation error paths through kernel logs
Monitoring Recommendations
- Forward dmesg and /var/log/kern.log output to a centralized log platform for kernel crash analysis
- Alert on repeated rtrs_srv failures, which may indicate attempted exploitation or unstable RDMA hardware
- Track kernel version inventory to confirm patch deployment status across RDMA-enabled hosts
How to Mitigate CVE-2026-64033
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits as soon as vendor builds become available
- Identify systems with RDMA/rtrs enabled by checking loaded modules with lsmod | grep rtrs
- Restrict local and remote access to RDMA management interfaces on unpatched systems
Patch Information
The fix reorders the cleanup logic in rtrs_srv_create_path_files() so that rtrs_srv_destroy_once_sysfs_root_folders(srv_path) executes before kobject_put(&srv_path->kobj). This ensures srv_path remains valid while the helper accesses it. Patches are available in the following stable kernel commits: 00904a73272b, 01e42aabaf76, 548f3956e53a, 5b7437339011, 92060ab1c511, b0e9706fb285, and eae62c5451e6. Refer to Kernel Patch eae62c5451e6 for the mainline commit.
Workarounds
- Unload the rtrs_server kernel module on hosts that do not require RDMA transport services
- Blacklist the rtrs modules in /etc/modprobe.d/ to prevent automatic loading
- Limit exposure of RDMA endpoints to trusted network segments until patched kernels are deployed
# Check whether rtrs modules are loaded and blacklist if unused
lsmod | grep -E 'rtrs|rnbd'
# Prevent automatic module loading
cat <<EOF | sudo tee /etc/modprobe.d/disable-rtrs.conf
blacklist rtrs_server
blacklist rtrs_client
blacklist rtrs_core
EOF
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
