CyberSecBulletin
CVE-2026-64033NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-64033 is a critical-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 01e42aabaf7632beb4bf235c7238b96c746d4144, 548f3956e53a7f7bde912d8129010b8986d5e602, 00904a73272b9f3ef3952fe69a833909dccad1ef as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.49% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 01e42aabaf7632beb4bf235c7238b96c746d4144 or 548f3956e53a7f7bde912d8129010b8986d5e602 or 00904a73272b9f3ef3952fe69a833909dccad1ef or 92060ab1c5115674cf319175550f85f68405121f, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.15.209 or 6.1.175 or 6.6.142 or 6.12.92, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxbab17b761c8974a869b04462be5d4dd9aad366b4 up to, but not including, 01e42aabaf7632beb4bf235c7238b96c746d4144; ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 up to, but not including, 548f3956e53a7f7bde912d8129010b8986d5e602; ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 up to, but not including, 00904a73272b9f3ef3952fe69a833909dccad1ef; ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 up to, but not including, 92060ab1c5115674cf319175550f85f68405121f; ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 up to, but not including, eae62c5451e67e8b033c1681fd3b85d7e9a9a28f; ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 up to, but not including, b0e9706fb2859064bb6c677554c4d20c713aa8e0; ae4c81644e9105d9f7f713bb0d444737bb6a0cf1 up to, but not including, 5b74373390113fba798a76b483837029ab010fef; 5.15.61 up to, but not including, 5.15.209; and 1 more ranges01e42aabaf7632beb4bf235c7238b96c746d4144, 548f3956e53a7f7bde912d8129010b8986d5e602, 00904a73272b9f3ef3952fe69a833909dccad1ef, 92060ab1c5115674cf319175550f85f68405121f, eae62c5451e67e8b033c1681fd3b85d7e9a9a28f, b0e9706fb2859064bb6c677554c4d20c713aa8e0
LinuxLinux Kernel5.15.61 up to, but not including, 5.15.209; 5.17 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.142; 6.7 up to, but not including, 6.12.92; 6.13 up to, but not including, 6.18.34; 6.19 up to, but not including, 7.0.11; 7.15.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path->kobj may already have been initialized. If a later step fails, the cleanup currently calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sysfs_root_folders(srv_path). kobject_put() may drop the last reference to srv_path->kobj and invoke the release callback, rtrs_srv_release(), which frees srv_path. The following call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then dereferences srv_path internally to access srv_path->srv, resulting in a use-after-free. This failure path is reached before rtrs_srv_create_path_files() returns success, so the successful-path lifetime handling is not involved. Fix this by destroying the sysfs root folders before calling kobject_put(&srv_path->kobj), so srv_path is still valid while the helper accesses it. This issue was found by a static analysis tool I am developing.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.