{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.176-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.94-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.12-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/rtrs: Fix use-after-free in path file creation cleanup  In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path-\u003ekobj may already have been initialized. If a later step fails, the cleanup currently calls kobject_put(\u0026srv_path-\u003ekobj) before rtrs_srv_destroy_once_sysfs_root_folders(srv_path).  kobject_put() may drop the last reference to srv_path-\u003ekobj and invoke the release callback, rtrs_srv_release(), which frees srv_path. The following call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then dereferences srv_path internally to access srv_path-\u003esrv, resulting in a use-after-free.  This failure path is reached before rtrs_srv_create_path_files() returns success, so the successful-path lifetime handling is not involved.  Fix this by destroying the sysfs root folders before calling kobject_put(\u0026srv_path-\u003ekobj), so srv_path is still valid while the helper accesses it.  This issue was found by a static analysis tool I am developing.",
  "id": "DEBIAN-CVE-2026-64033",
  "modified": "2026-09-14T16:47:43.614280091Z",
  "published": "2026-07-19T16:17:43.493Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64033"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-64033"
  ]
}