CVE-2026-64033

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs: Fix use-after-free in path file creation cleanup

In the error path of rtrssrvcreatepathfiles(), the sysfs root folders

may already have been created and srv_path->kobj may already have been

initialized. If a later step fails, the cleanup currently calls

kobjectput(&srvpath->kobj) before

rtrssrvdestroyoncesysfsrootfolders(srv_path).

kobjectput() may drop the last reference to srvpath->kobj and invoke the

release callback, rtrssrvrelease(), which frees srv_path. The following

call to rtrssrvdestroyoncesysfsrootfolders(srv_path) then

dereferences srvpath internally to access srvpath->srv, resulting in a

use-after-free.

This failure path is reached before rtrssrvcreatepathfiles() returns

success, so the successful-path lifetime handling is not involved.

Fix this by destroying the sysfs root folders before calling

kobjectput(&srvpath->kobj), so srv_path is still valid while the helper

accesses it.

This issue was found by a static analysis tool I am developing.