CVE-2026-64033

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs: Fix use-after-free in path file creation cleanup

In the error path of rtrs_srv_create_path_files(), the sysfs root folders

may already have been created and srv_path->kobj may already have been

initialized. If a later step fails, the cleanup currently calls

kobject_put(&srv_path->kobj) before

rtrs_srv_destroy_once_sysfs_root_folders(srv_path).

kobject_put() may drop the last reference to srv_path->kobj and invoke the

release callback, rtrs_srv_release(), which frees srv_path. The following

call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then

dereferences srv_path internally to access srv_path->srv, resulting in a

use-after-free.

This failure path is reached before rtrs_srv_create_path_files() returns

success, so the successful-path lifetime handling is not involved.

Fix this by destroying the sysfs root folders before calling

kobject_put(&srv_path->kobj), so srv_path is still valid while the helper

accesses it.

This issue was found by a static analysis tool I am developing.